Poisoned Pipeline / Incidents / AS249

AS249 · 2019-07

PureScript installer dependencies were sabotaged

Windows softwareInstaller / update channel

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0209 Compromise package registry or CDN origin

supply-chain campaign

Sources

• https://harry.garrood.me/blog/malicious-code-in-purescript-npm-installer/
• https://github.com/purescript/npm-installer/issues/12
• https://jarrodoverson.com/post/how-two-malicious-npm-packages-targeted-sabotaged-one-other-fed7199099c8/
• https://www.theregister.com/security/2019/07/15/malicious-code-ousted-from-purescripts-npm-installer-but-who-put-it-there-in-the-first-place/457385
• https://securityaffairs.com/88433/hacking/npm-installer-purescript-compromised.html
• https://sechub.in/view/1744975