New AWS Console Supply Chain Attack Lets Attackers Hijack AWS GitHub Repositories

A critical AWS CodeBuild webhook regex misconfiguration (dubbed CodeBreach) allowed bypass of GitHub user-ID filters via “eclipse” events, enabling malicious pull requests to trigger privileged builds and extract a maintainer Personal Access Token; a PoC targeted aws/aws-sdk-js-v3 and other AWS repos, posing a supply-chain risk to the AWS JavaScript SDK and the AWS Console. Wiz disclosed the issue and AWS patched the regex within 48 hours, revoked tokens, hardened protections, audited builds, and reported no customer data impact.