Zapocalypse Attack Lets Threat Actors Hijack Zapier Accounts

The 'Zapocalypse' research shows a realistic attack chain against Zapier: memory scraping of a Lambda process recovered STS credentials after environment vars were scrubbed, those credentials allowed listing and downloading private ECR images, image build metadata revealed a reusable NPM publish token, and publishing a malicious version of a frontend design-system package would let attacker-controlled JavaScript run in every authenticated user's browser enabling full account takeover actions within Zapier.