Blessed Zapocalypse, Who Climbed the Chain to the Package

Patron of cloud automations, IAM roles named better than they are configured, and secrets left in Dockerfiles.

Life

In 2026 Token Security described Zapocalypse, an attack chain against Zapier. Starting from a free account and code run inside a serverless function, the researchers escaped the sandbox, recovered cloud credentials from memory, explored the container registries and found, in an image's build history, an NPM publishing token leaked there by a Dockerfile, powerful enough to publish packages loaded into users' sessions. Not a single link was a zero-day: all were well-known anti-patterns. Zapier fixed it quickly, so he remains blessed.

Prayer

O Blessed Zapocalypse, who climbs a chain of small mistakes to the sky, let each of our links be strong on its own. Amen.

How to celebrate

Celebrated by giving NPM tokens a short lifetime, taking secrets out of Dockerfiles, and treating user code as hostile.

A chain of small oversights holds up a great disaster.