# Finding AI Supply Chain Components

> Techniques for mapping AI supply chain components including models, datasets, APIs, and dependencies to identify attack surfaces in AI platform environments.

- **URL:** https://hackindex.io/platforms/ai/reconnaissance/finding-ai-supply-chain-components
- **Path:** AI Platforms > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/ai/reconnaissance.md)
- **Published:** 2026-03-18
- **Updated:** 2026-08-11

The AI supply chain includes every component that feeds into a production model: training datasets, base model weights, fine-tuned adapters, Python packages, and the pipelines that assemble them. Each is a potential attack surface. Mapping these components during reconnaissance identifies which supply chain attacks are feasible before the engagement moves into active exploitation.

Supply chain components to identify:

- Base model weights and fine-tuned adapters (Hugging Face, S3, internal registries)
- Training and evaluation datasets
- Python dependencies (LangChain, LlamaIndex, transformers, vector DB clients)
- Model provider API keys and Hugging Face tokens
- CI/CD pipelines that build, fine-tune, or deploy models

## AI Supply Chain Reconnaissance on Hugging Face

Many organisations publish models on Hugging Face under their organisation name. Check for public model repositories, datasets, and spaces:

```bash
curl -sk 'https://huggingface.co/api/models?search=target-org&limit=20' | python3 -c "import sys,json; [print(m['modelId'], m.get('downloads',0)) for m in json.load(sys.stdin)]"
# target-org/finance-llm-v1 4821
# target-org/internal-embeddings 312
```

```bash
curl -sk 'https://huggingface.co/api/datasets?search=target-org&limit=20' | python3 -c "import sys,json; [print(d['id']) for d in json.load(sys.stdin)]"
```

Public Hugging Face model repositories contain model cards that reveal training data sources, base models used for fine-tuning, and evaluation datasets. The model card is reconnaissance gold: it lists exactly what went into the model and where it came from.

## Inspect Model Cards and Repository Metadata

Pull the full model card and repository file list for any identified models:

```bash
curl -sk 'https://huggingface.co/api/models/target-org/finance-llm-v1' | python3 -m json.tool | grep -iE 'base_model|dataset|tags|pipeline|library'
# "base_model": "meta-llama/Llama-3.1-8B-Instruct",
# "datasets": ["target-org/finance-docs"],
# "tags": ["finance", "llama", "lora"]
```

```bash
curl -sk 'https://huggingface.co/api/models/target-org/finance-llm-v1?full=true' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(s['rfilename']) for s in d.get('siblings',[])]"
# README.md
# config.json
# adapter_config.json
# adapter_model.safetensors
# tokenizer.json
```

The presence of `adapter_config.json` and `adapter_model.safetensors` confirms the model is a LoRA fine-tune rather than a full fine-tune. LoRA adapters are smaller files that are easier to inspect and potentially replace. The base model listed in the card is the upstream dependency: a compromised base model affects all fine-tunes built on top of it.

## Check for Exposed Model Storage

Model weights are large files often stored in cloud object storage. Misconfigured buckets sometimes expose these publicly:

```bash
curl -sk https://s3.amazonaws.com/target-org-models/ | grep -iE 'Key|model|weight|safetensors|bin|gguf'
```

```bash
for bucket in target-org-models target-ml-artifacts target-ai-weights target-models; do curl -sk https://s3.amazonaws.com/$bucket/ | grep -q 'ListBucketResult' && echo "OPEN: $bucket"; done
```

## Search for Leaked API Keys and Model Credentials

AI applications require API keys for model providers, Hugging Face tokens for model downloads, and sometimes credentials for vector databases. These frequently leak into public repositories:

```bash
trufflehog github --org=target-org --only-verified 2>/dev/null | grep -iE 'openai|anthropic|huggingface|cohere|pinecone|weaviate'
```

```bash
trufflehog git https://github.com/target-org/ai-application --only-verified 2>/dev/null
```

A leaked Hugging Face token with write access allows publishing malicious model versions to the organisation's repository. A leaked OpenAI or Anthropic API key provides direct access to the production model without going through the application. A leaked Pinecone or Weaviate API key gives direct vector database access for RAG poisoning.

## Audit Python Dependencies for AI Packages

If a requirements file is accessible, audit it for known vulnerable AI framework versions and suspicious packages:

```bash
curl -sk https://$TARGET_DOMAIN/requirements.txt -o /tmp/reqs.txt && pip-audit -r /tmp/reqs.txt --format json | python3 -c "import sys,json; vulns=json.load(sys.stdin); [print(v['name'],v['version'],v['vulns']) for v in vulns if v['vulns']]"
```

## Search GitHub for Internal AI Configuration

GitHub advanced search surfaces AI-related configuration files, environment files, and deployment scripts that reference internal AI infrastructure:

```bash
curl -sk -H 'Authorization: token $GITHUB_TOKEN' 'https://api.github.com/search/code?q=org:target-org+OPENAI_API_KEY+OR+ANTHROPIC_API_KEY+OR+HUGGINGFACE_TOKEN' | python3 -c "import sys,json; d=json.load(sys.stdin); [print(i['repository']['full_name'], i['path']) for i in d.get('items',[])]"
```

## References

- [Hugging Face Hub: API documentation](https://huggingface.co/docs/hub/api) - Models, datasets, and spaces API reference for enumeration
- [trufflesecurity/trufflehog on GitHub](https://github.com/trufflesecurity/trufflehog) - Secret scanning for GitHub organisations and repositories
- [pypa/pip-audit on GitHub](https://github.com/pypa/pip-audit) - Python dependency vulnerability auditing