Poisoned Pipeline / Incidents / AS23
GitHub repo jacking (dependency URL takeover)
Security Innovation documented dependency repository hijacking (repo
jacking): when a GitHub user renames or deletes their account, the old
owner/repo URL can be re-registered. Projects that pin dependencies by
GitHub URL, submodule, or git+ protocol then fetch attacker-controlled
code. Their analysis found over 70,000 impacted open-source projects.
GitHub's popular-namespace retirement mitigates some cases; it does not
cover smaller repos that popular projects still clone. This is how T0115
was identified — systematic research, not a single headline breach.
Mapped techniques
supply-chain GitHub username / repo namespace reuse
Re-registering a vacated GitHub owner name breaks the redirect and
serves a replacement repository at the old URL.
Direct GitHub URL dependencies (and git+https in manifests) are the
fetch path that makes jacking reach builds.
The recreated repository can publish whatever the new owner wants
under a name consumers already trust.
Framework gaps noted
- GitHub later retired some popular namespaces; This catalogue still treats jacking of non-popular names as in scope.