cicd-supply-chain

This is a dual-use CI runner recon/pivot-assessment script. It is mostly read-only but performs high-value reconnaissance: searches env/processes for secrets, probes cloud metadata services (AWS IMDS and GCP metadata), checks docker.sock exposure, and lists cached VCS/SSH credential indicators. It does not appear to upload/exfiltrate data externally, does not modify the host, and contains no obvious backdoor/persistence. The main risks are (1) potential sensitive data disclosure to stdout logs (process args + token matches) and (2) cloud credential discovery via metadata probing if run in a credential-rich environment. Presence of `eval` is an additional anomaly, though the variable names are hardcoded.

The provided file is highly suspicious and effectively functions as an attacker playbook for CI secret exfiltration and GitHub Actions OIDC-to-cloud credential abuse. It contains actionable, step-by-step examples for outbound data exfiltration, OIDC JWT minting, and unauthorized role assumption via misconfigured IAM trust policies, along with evasion guidance to bypass CI secret masking. If this content is present within a dependency or distributed artifact, it warrants immediate scrutiny/removal and investigation of how it might be executed in CI. Confidence is limited by the lack of a conventional executable module, but the malicious intent and operational specificity are high.