Red Team vs. the Build Pipeline

This ReversingLabs webinar, part of the RL Spectra Collective series, delivers a tactical demonstration of how attackers compromise a CI/CD build pipeline live, and the defenses that stop them, aimed at DevSecOps practitioners and AppSec professionals.

RL Community Manager Kadi McKean is joined by Juan Aguirre, Sr. Security Researcher at Safety Cybersecurity, who demonstrates how a CI/CD pipeline can be compromised through stolen secrets, poisoned dependencies, and misconfigured runners, before RL Sr. Threat Researcher Lucija Valentić walks through real-world cases built on these techniques.

Attendees will see why red teaming the build pipeline is essential to software supply chain security and learn which of these techniques have already fuelled real-world OSS supply chain, account takeover, and dependency confusion attacks, including the Shai-Hulud worm that cascaded across npm in late 2025.