T08 · Insecure Dependencies
Warning
- Location
fastlane.md:7- Finding
Unpinned Fastlane installation creates a mutable CI supply-chain dependency
- Content
View full analysis
keystore.jks - echo "$PLAY_SERVICE_ACCOUNT" | base64 -d > service-account.json - gem install fastlane - fastlane internal ``` ### Technical Analysis The documented installation commands resolve and install the latest available Fastlane package at execution time. No reviewed version, lockfile, or integrity constraint is specified. Consequently, the code executed by the deployment workflow can change without any corresponding modification to this project. The GitLab example is particularly sensitive because it installs Fastlane immediately after decoding the Android signing keystore and Google Play service-account credentials. Installation hooks or subsequently executed compromised package code could run inside a CI job containing these assets. This is a supply-chain weakness rather than evidence that the current Fastlane package is malicious. Exploitation depends on compromise of an upstream package, package repository, dependency, or package-resolution path. ### Attack Path 1. An attacker compromises a Fastlane release, one of its transitive dependencies, or the package-resolution infrastructure. 2. The CI job executes `gem install fastlane` without a version constraint or lockfile. 3. The runner downloads and installs the attacker-controlled package version. 4. The job executes `fastlane internal`, loading the compromised package in the deployment environment. 5. Malicious package code reads the decoded keystore, service-account file, environment variables, or other CI credentials. 6. The attacker exfiltrates those crede ...[truncated 669 chars]- Remediation
View remediation