RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers

How it was found

Summary

The duckduckgo/content-scope-scripts repository's .github/workflows/semver-label.yml GitHub Actions workflow uses pull_request_target trigger without any access controls, checks out and executes untrusted fork PR code via npm install + npm run build, and subsequently runs a trusted script with ANTHROPIC_API_KEY in the environment. An attacker can exfiltrate the API key, abuse the GITHUB_TOKEN (which has pull-requests: write) to manipulate semver labels on any PR, and chain into the automated release pipeline (semver-release.yml → build.yml) to publish a poisoned release consumed by every DuckDuckGo browser and extension across all platforms.

The content-scope-scripts README describes this package as "shared JavaScript used within ALL DuckDuckGo browsers."

This report contains 4 findings:

1. RCE + ANTHROPIC_API_KEY exfiltration via semver-label.yml
2. Supply chain attack via label manipulation → release pipeline
3. DAX_PAT exposure via related pull_request_target workflows
4. 10 workflows using pull_request_target across the DuckDuckGo org

Vulnerability Details

Root Cause

pull_request_target runs in the context of the BASE repository with access to secrets. The workflow checks out and executes code from the PR HEAD (attacker-controlled on fork PRs). There are zero access controls — any GitHub user can trigger this by opening a fork PR.

Vulnerable Workflow (semver-label.yml)

Impact

1. RCE + Secret Exfiltration: Any GitHub user can execute arbitrary code on the Actions runner by opening a fork PR. ANTHROPIC_API_KEY is directly exfiltrable, enabling API abuse at DuckDuckGo's expense.

2. Release Pipeline Manipulation: GITHUB_TOKEN with pull-requests:write can add semver labels to any PR, triggering the automated release pipeline on merge. The attacker controls when releases happen.

3. Supply Chain Compromise — All DuckDuckGo Browsers: content-scope-scripts is "shared JavaScript used within ALL DuckDuckGo browsers." A poisoned release propagates to Android, iOS, macOS, Windows browsers, Chrome extension, Firefox extension, and the autofill component — affecting tens of millions of users across every platform DuckDuckGo supports.

4. No Release Signing: build.yml creates releases with no code signing or integrity verification. Downstream consumers pull from the releases branch with no signature validation.