Poisoned Pipeline / Techniques / T0111
Malicious code contribution to an open-source repository
A malicious code contribution to an open-source repository attack is a type of cyber attack that involves an attacker submitting code with malicious intent to an open-source repository.
Open-source repositories are used to store and manage code for open-source software projects, and they rely on community contributions to improve and maintain the codebase.
In this attack, the attacker may submit a seemingly harmless code contribution to the repository. However, the code contains a hidden malware payload that can be triggered later to cause damage.
Alternatively, the code may include a backdoor that allows the attacker to gain unauthorized access to the system running the open-source software.
Once the code is accepted into the repository, it can be difficult to detect the presence of the malicious payload.
The code may be integrated into the open-source project, distributed to other projects that depend on it, and even included in software distributions used by many people.
This can result in a wide-scale compromise of systems that use the affected code.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below. DEF CON 32: XZ backdoor story (Roccia) — maintainer commits.
- https://thenewstack.io/php-supply-chain-attack-shows-open-sources-virtues-and-vices/
- https://www.darkreading.com/vulnerabilities-threats/35k-malicious-code-insertions-in-github-attack-bug-bounty
- https://www.legitsecurity.com/blog/how-a-massive-widespread-malware-attack-almost-occurred-on-github
- https://defcon.org/html/defcon-32/dc-32-speakers.html#54442
Mitigations
- M1110 Implement contributor validation
- M1503 Implement SCA analysis
- M1730 Implement code reviews
- M1732 Implement code scanning for security risks
Detections
- D1260 Implement regular security audit and review
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (34)
- npm event-stream / flatmap-stream
- Wrapper Link Elementor plugin created backdoors
- Forged and timestamp-cloned commits planted a preinstall dropper in hugo-paper and mevn-cli
- BdThemes plugins poisoned through the vendor's banner feed
- Better MC modpacks shipped Fracturiser malware
- Sky Villages mod shipped Fracturiser malware
- Blaze Widget plugin created backdoors
- tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
- WordPress download enabled remote execution
- @subql/common 5.8.3 published after a CI artifact swap
- Essential Plugin WordPress.org portfolio backdoor
- SquirrelMail plugin archives tried to mail passwords out
- php.net git server Zerodium backdoor
- pub.dev universal_file_viewer ships XCSSET (infected maintainer)
- ARVE WordPress plugin shipped a hardcoded admin backdoor
- GlassWorm across GitHub, npm, Open VSX, VS Code, Python
- JuiceStealer PyPI phishing and typosquats
- tj-actions/changed-files GitHub Action
- XZ Utils backdoor
- electron-native-notify planted in Agama / Komodo wallet
- GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
- DPRK VS Code dictionary and tasks.json droppers
- Social Warfare plugin created backdoors
- Malicious Go module plus 222 GitHub lure repos
- ulid-xyz RAT via ioredis-xyz transitive chain
- Contagious Interview stage-2 in Git pre-commit / post-checkout hooks
- Simply Houses mod shipped Fracturiser malware
- Treecapitator plugin shipped Fracturiser malware
- Simply Show Hooks plugin created backdoors
- WordPress.org plugins created admin backdoors
- ShapedPlugin Pro builds backdoored in the vendor pipeline
- Neutralinojs org force-push (DPRK / PolinRider)
- Fake VS Code security-alert GitHub malware campaign
- PolinRider (DPRK) Git-to-registry jump