Poisoned Pipeline / Incidents / AS84
npm bin-entry harvesting against Google CLIs
SafeDep documented 21 malicious npm packages that targeted Google by
squatting CLI binary names from scoped packages, not the package names
themselves. Installing an unscoped package whose bin field collides
with a scoped Google CLI can put attacker code on PATH. Standard
dependency-confusion defenses that watch package names miss this.
Mapped techniques
- T0120 Dependency confusion
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0101 Discover technology stacks
supply-chain bin name collision
Collision on bin/CLI names rather than package names.
21 unscoped packages with colliding bin entries.
Attacker binary lands on PATH at install.
Chose a JavaScript library embedded across hundreds of thousands of sites.