Boost Security Releases SmokedMeat to Demonstrate CI/CD Pipeline Attack Chains

Summary

Boost Security released SmokedMeat, an open-source tool that demonstrates how a CI/CD pipeline vulnerability can lead to runner compromise, credential theft, cloud access and further exposure in a team’s infrastructure.

Key points

SmokedMeat runs live attack-chain demonstrations against a team’s CI/CD infrastructure, starting from a flagged pipeline vulnerability.
The tool can deploy a payload, compromise a runner and harvest credentials from process memory.
It can use harvested credentials to access cloud resources, expose private repositories and map the potential blast radius.
The article links the risks to the TeamPCP campaign, which it says compromised Trivy, Checkmarx, LiteLLM and dozens of npm packages in March 2026.
Boost Security says its Poutine scanner had flagged vulnerabilities in Trivy’s pipeline months before the campaign; those findings went unpatched.
SmokedMeat is open source and available for free on GitHub.

Article Details

Event Type: Release of SmokedMeat, an open-source framework for demonstrating attack chains against CI/CD pipelines.
Impact: SmokedMeat can deploy payloads against a team's CI/CD infrastructure, compromise runners, harvest credentials from process memory, use them to obtain cloud access, expose private repositories, and map the potential blast radius. The article reports that the TeamPCP campaign compromised Trivy, Checkmarx, LiteLLM, and dozens of npm packages, illustrating how CI/CD vulnerabilities can cascade across software supply chains.