AI Incident Response in Action: Investigating a Cloud Supply Chain Attack on AWS

Quick answer: OpsRabbit investigated the axios supply chain vulnerability across AWS telemetry and runtime surfaces, then validated no production impact with evidence-backed analysis.

When a cloud supply chain attack like the Axios issue hits, every second is uncertainty.

The question isn't just:

"Are we compromised?"

It's:

"Can we prove we are NOT compromised?"

In this case, the threat was the malicious axios releases (1.14.1 / 0.30.4) — a classic JavaScript supply chain attack.

The Challenge: Incident Response Across AWS

OpsRabbit investigated across:

• AWS Lambda
• ECS
• ECR
• EC2
• GitLab runners

This is not monitoring. This is cloud incident response at scale.

How OpsRabbit Investigates

Cloud Telemetry (CloudTrail)

Checked deployment and runtime events in the exposure window.

Workload Inspection

Validated Lambda, ECS, and ECR for compromised dependencies.

Runtime Forensics

Inspected GitLab runner via SSM:

• No npm logs
• No malicious packages
• No build artifacts

Timeline Correlation

Mapped all signals to the attack window.

Findings

• No Lambda updates
• No ECS deployments
• No image pushes
• No build activity

Conclusion: No confirmed impact from the axios attack.

Hidden Risk Discovered

OpsRabbit identified:

⚠️ Static AWS credentials in GitLab runner

This is a major security risk independent of the attack.

Why This Matters

Traditional tools detect.

OpsRabbit explains.

It builds a full narrative using:

• telemetry
• runtime inspection
• reasoning

Final Thought

Supply chain attacks are rising.

Cloud environments are complex.

Manual investigation won't scale.

AI incident response is the future of cloud security.