HOW WE HACKED A SOFTWARE SUPPLY CHAIN FOR $50K

Summary from the TLDR Web Dev newsletter

Two bug bounty hunters collaborated to find a critical vulnerability in a company's recently acquired subsidiary. They discovered a GitHub Actions token embedded within a Docker image, allowing them to potentially compromise the entire development-to-production lifecycle. By analyzing the Docker image layers using tools like `dive` and `dlayer`, they recovered a private npm token, letting them inject malicious code into a private package used across the company's systems.