Detect a Supply-Chain Attack in CI Logs
devsecops · medium · +50 XP
Target
GET /api/lab/supply-detect-101/logs (CI run log + DNS lookups)
POST /api/lab/supply-detect-101/submit body {suspicious_domain, suspicious_package}
Goal: legit DNS goes to npmjs.org, github.com, jfrog.io. ONE extra lookup hits a .click TLD during npm install. Find that domain + the package install that triggered it.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/supply-detect-101/
// reuse on the cli
// submit flag
// no solves yet
previous
Sigstore Keyless Image Signing
// end of devsecops
12 of 12 · devsecops