SmokedMeat: Open-source tool shows what attackers do inside CI/CD pipelines

SmokedMeat is an open-source framework from Boost Security that executes end-to-end attack chains against CI/CD infrastructure to demonstrate the real impact of pipeline vulnerabilities — from deploying payloads and compromising runners to harvesting credentials and pivoting to cloud resources. The report cites the March 2026 TeamPCP supply-chain campaign, which compromised Trivy, Checkmarx, LiteLLM, and many npm packages, as evidence of how pipeline injection and unpatched findings can lead to large-scale cascade attacks; SmokedMeat is offered to help teams visualize and prioritize remediation.