Poisoned Pipeline

Poisoned Pipeline / Preview

Five-stage cut

Not in the nav. A reading of the catalogue as five supply-chain stages, using the platform and realm tags we already have. Nothing was retagged for this page. Each column has the same 5-year axis, from 1975. Ten-year blocks would hide the jump from 2015–2019 into 2020–2024 and 2025–2029.

Development environment

Machine and tools before code is pushed: IDE, agent, workstation.

89
incidents touch this stage
5
techniques, including ones that also sit elsewhere

AI coding agents 37 Developer workstation 33 VS Code / IDE 23 Browser extensions 18 MCP 10

  • T0152 IDE
  • T0153 Compromised developer workstation
  • T0154 Malicious IDE extension
  • T0210 Poison AI coding-agent config or workspace
  • T0213 Orchestrate AI-agent fleet as the intrusion workforce
75
80
85
90
95
00
05
10
315
820
7825
5-year blocks. Height is this column only. The number is the count.

Code repository

Source control: commits, review, keys, the repo itself.

95
incidents touch this stage
40
techniques, including ones that also sit elsewhere

Git / GitHub 94 GitLab 4 Bitbucket 1 Codeberg 1

  • T0100 Discover naming conventions
  • T0101 Discover technology stacks
  • T0102 Discover used open-source dependencies
  • T0103 Scan public artifacts for secrets
  • T0104 Discover coding flaws
75
80
85
90
95
00
205
210
315
1720
7125
5-year blocks. Height is this column only. The number is the count.

CI/CD

Pipelines, runners, and the service that builds.

56
incidents touch this stage
58
techniques, including ones that also sit elsewhere

GitHub Actions 33 CI/CD SaaS 25 Jenkins 4 GitLab CI 3 CircleCI 3 TeamCity 1

  • T0106 Scan configuration on public resources
  • T0112 Compromised token
  • T0116 Shadow IT
  • T0120 Dependency confusion
  • T0121 Compromised legitimate artifact
75
80
85
90
95
00
105
110
15
1320
4125
5-year blocks. Height is this column only. The number is the count.

Artifact / container

Registries, images, signatures, hosted build outputs.

205
incidents touch this stage
57
techniques, including ones that also sit elsewhere

npm 135 PyPI 38 CDN / web assets 17 RubyGems 12 Packagist / Composer 11 Go modules 7

  • T0100 Discover naming conventions
  • T0101 Discover technology stacks
  • T0102 Discover used open-source dependencies
  • T0103 Scan public artifacts for secrets
  • T0107 Discover internal artifacts names
75
80
85
90
95
00
05
10
1015
2120
17425
5-year blocks. Height is this column only. The number is the count.

Deployment / cloud / exec

Where it runs: cloud, IaC apply, customer environment.

44
incidents touch this stage
47
techniques, including ones that also sit elsewhere

Installer / update channel 25 Certificates / trust stores 11 Kubernetes 5 Terraform 3 AWS 3 Azure 2

  • T0105 Active scanning
  • T0106 Scan configuration on public resources
  • T0112 Compromised token
  • T0113 Compromised user account
  • T0114 Compromised service account
75
80
85
90
95
00
05
510
1515
520
1925
5-year blocks. Height is this column only. The number is the count.

Does this cover the five?

Yes, in pieces. No, not as five sections. Repository, CI/CD, and registries are thick. The developer environment has incident tags (IDE, agents, MCP) and only a handful of techniques, and those techniques are also tagged as CI or source control. Deployment and cloud have many techniques and almost no incident tags: we record the registry or the operating system, not the place it was deployed. 19 incidents are tagged only Windows, Linux, or macOS, which is not one of these stages. 68 techniques sit in more than one stage already.

A flow of these five is a useful second view. It should not replace the matrix until the tags match the stages. Repo-jacking and malicious commits are tagged open-source security, so this cut files them under artifact, not repository.

Not a pipeline stage

Application bugs inherited with the technique set. They are not a sixth stage.