Zapocalypse: Five‑Step Chain That Could Have Hijacked Zapier
Token Security uncovered a five‑step attack chain—dubbed “Zapocalypse”—that could have let an adversary publish malicious JavaScript to every authenticated Zapier user’s browser, achieving full account takeover. Zapier patched the flaw within weeks and revoked the compromised NPM token, highlighting supply‑chain risks in SaaS automation platforms.