Poisoned Pipeline / Techniques / T0102
Discover used open-source dependencies
This technique involves identifying the open-source dependencies used in an application, such as third-party libraries, frameworks, and other related components.
By identifying the specific open-source dependencies used in an application, an attacker can gain insights into the potential vulnerabilities associated with those components, as well as potential attack vectors and weak spots in the application.
For example, an attacker might use this technique to identify specific versions of a vulnerable open-source library used in an application, which could then be exploited to gain unauthorized access to the application or the underlying system.
Where this idea came from
Birsan dependency confusion and llms.txt unclaimed-package squatting both started by enumerating a target’s dependencies. Also OWASP guidance.
- https://safedep.io/defi-infostealer-fake-arbitrage-bot-npm
- https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html
Mitigations
- M1500 Verify third-party artifacts and open-source libraries
- M1502 Define trusted package managers and repositories
- M1503 Implement SCA analysis
- M1720 Implement regular patches and updates
- M1732 Implement code scanning for security risks
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (3)
- Placeholder domain third-party.com turned live ClickFix server
- Dependency confusion (Alex Birsan)
- Unclaimed packages in official llms.txt files