Poisoned Pipeline / Mitigations / M1200
M1200
Verify package authenticity
Before installing any package, it's important to verify its authenticity. This can include checking the package's digital signature or using a package manager that supports package verification.
Applies to
- T0209 Compromise package registry or CDN origin
- T0120 Dependency confusion
- T0198 Malicious Build Time Dependencies
- T0157 Combosquatting
- T0207 Skip or forge artifact integrity verification
- T0205 Compromise third-party CDN or hosted web asset
- T0206 Forge or omit build provenance
- T0201 Customers compromised
- T0136 Brandjacking