A newly disclosed exploit chain dubbed Zapocalypse demonstrates how a low-privilege code-execution feature within Zapier could have been chained into a supply chain attack path with platform-wide account takeover impact.
Token Security said its researcher will present the full chain at fwd:cloudsec North America on June 1, 2026.
The attack begins inside “Code by Zapier”, a legitimate product feature that lets users execute arbitrary Python or JavaScript within a Zap.
Token Security’s research team confirmed that this sandbox runs inside an AWS Lambda environment and that os.system() executes without restriction, providing OS-level command access as the first foothold.
Zapocalypse Attack Chain
| Stage | Primitive | Technical Detail |
|---|---|---|
| 1 | Sandbox Reconnaissance | os.system confirms OS-level access inside Lambda |
| 2 | Credential Recovery | /proc/self/mem regex scanning recovers orphaned STS tokens |
| 3 | Lateral Movement | allow_nothing_role permits ECR enumeration and image pulls |
| 4 | Secret Hunting | High-privilege NPM token exposed in container build metadata |
| 5 | Supply-Chain Reach | Publish rights to zapier-design-system, loaded on every authenticated session |
The critical insight at Stage 2 is architectural. Zapier’s Lambda handler scrubbed AWS credentials using del os.environ[k] before executing user code.
However, Python’s del operator removes the reference and calls unsetenv() it does not zero the underlying heap bytes. Because Lambda containers are warm-started across many invocations, orphaned STS session tokens from prior calls remain in process memory.
The team recovered live credentials by scanning /proc/self/mem with regex patterns anchored to known AWS key prefixes. With recovered STS credentials in hand, the researchers turned to lateral movement.
The IAM role allow_nothing_role , whose name implies a restrictive policy, actually permitted ecr:DescribeRepositories, ecr:ListImages, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer.
That was sufficient to enumerate and pull from Zapier’s private container registry, which contains over 1,000 repositories.
Because ecr:GetAuthorizationToken was blocked, the team bypassed Docker entirely, pulling container layers via direct ECR API calls and presigned S3 URLs a technique that sidesteps Docker-based monitoring and registry-side audit logs.
Scanning pulled images, the researchers found a high-privilege NPM publish token not in the container filesystem but in the image config history metadata that records Docker build steps.
A CI ARG or ENV instruction had serialized the token into the image, where it remained visible to anyone with BatchGetImage rights.
The token carried write scope, applied to all packages the account could publish, and had bypass_2fa: true set standard for CI tokens that cannot complete interactive MFA.
That token granted publishing rights to zapier-design-system, a private package confirmed loading on every authenticated zapier.com session.
Publishing a tampered version would have injected attacker-controlled JavaScript directly into logged-in users’ browsers, within Zapier’s own origin, with no cross-origin restrictions, enabling full platform account takeover.
In practical terms, attackers would not have received raw OAuth tokens or third-party API credentials, as those remain server-side.
However, they could have acted as the victim inside Zapier, creating or modifying Zaps, Tables, MCP servers, and workflows using the victim’s existing app connections.
A separate, narrower finding involved a hardcoded Zapier Actions MCP key inside a pulled LiteLLM container image, scoped to a LiteLLM co-founder’s account and capable of sending email through their live Gmail connection, illustrating how embedded secrets create immediate identity risk independently of any broader chain.
Token Security reported the vulnerability on February 12, 2026. Zapier acknowledged the report within hours, revoked the NPM token, and tightened the ECR role policy by February 16.
Full remediation was confirmed on March 5, 2026. The program’s maximum bounty of $3,000 was paid, and Zapier committed to reviewing the cap.
- Scrubbing secrets after code execution begins is not a sufficient control if untrusted code runs in the same process that previously held credentials process isolation is the correct fix.
- IAM role names are not access controls that enumerate actual permissions to verify least privilege
- Docker
ARG/ENVinstructions persist in the image config history useRUN --mount=type=secretfor CI tokens - Restricting
ecr:GetAuthorizationTokendoes not prevent image extraction if layer-fetch APIs remain accessible
Zapocalypse is a reminder that supply-chain reach often begins with ordinary misconfigurations.
When runtime isolation, IAM least privilege, secret handling, and package publishing controls fail in combination, a routine sandbox feature can become the first step toward platform-wide compromise.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
