Poisoned Pipeline / Mitigations / M1502
M1502
Define trusted package managers and repositories
When pulling a package by name, the package manager might look for it in several package registries, some of which may be untrusted or badly configured.
If the package is pulled from such a registry, there is a higher likelihood that it could prove malicious.
In order to avoid this, configure packages to be pulled from trusted package registries.
Applies to
- T0152 IDE
- T0129 Typosquatting
- T0102 Discover used open-source dependencies
- T0120 Dependency confusion
- T0164 Inject malicious dependency to privileged user repository
- T0115 Repojacking
- T0157 Combosquatting
- T0151 Installation scripts
- T0172 Runtime backdoor
- T0170 Malicious compiler or interpreter
- T0150 Runtime logic bomb
- T0121 Compromised legitimate artifact
- T0191 Malicious code in artifacts
- T0136 Brandjacking