Poisoned Pipeline

Poisoned Pipeline / Techniques / T0121

T0121 · Resource Development · TA02 · observed in 71 incident(s)

Compromised legitimate artifact

Container Security Open Source Security CI/CD Posture

A compromised legitimate artifact attack is a type of cyber attack in which an attacker replaces a legitimate package or container image with a malicious version, often without the knowledge of the original developer or distributor.
This attack takes advantage of the trust that users place in legitimate packages or container images, which are often used to deploy software across multiple environments.
In this attack, the attacker may gain access to the repository or registry where the legitimate artifact is stored, either by exploiting a vulnerability or through social engineering tactics.
The attacker then replaces the legitimate artifact with a malicious version that contains malware or other harmful code.
Once the compromised artifact is downloaded and deployed, it can compromise the system and potentially cause significant harm, such as stealing sensitive data or taking control of the system.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below. DEF CON 32: XZ backdoor story — backdoored liblzma release.

Mitigations

Detections

Observed in incidents (71)

References