Accounts in public registry

Open Source Security SCM Posture

An attacker can use accounts in public registries, such as PyPI or DockerHub, to perform a supply chain attack in several ways.
One approach is to compromise the credentials of a legitimate developer account and use it to upload malicious packages or container images.
The attacker can then promote the malicious artifact by using misleading descriptions or keywords, potentially increasing the number of downloads.
Alternatively, the attacker can create a fake developer account and upload malicious packages or container images using it.
The attacker may use a similar username or avatar to legitimate developers to trick users into thinking the account is legitimate.
Once the malicious artifact is uploaded, the attacker can promote it using various techniques, such as hijacking popular package names or using misleading descriptions.
Another approach is to target the infrastructure used by public registries, such as the servers or the communication channels used by developers to upload packages or container images.
An attacker may compromise the infrastructure and use it to inject malicious code into legitimate packages or container images as they are being uploaded.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

Mitigations

M1500 Verify third-party artifacts and open-source libraries
M1503 Implement SCA analysis
M1720 Implement regular patches and updates
M1732 Implement code scanning for security risks

Detections

D1262 Implement vulnerability assessment
D1500 Configure monitoring of used artifacts and open-source libraries
D1510 Implement Intrusion Detection System and anti-malware

Accounts in public registry

Where this idea came from

Mitigations

Detections

Observed in incidents (17)

References