Poisoned Pipeline

Poisoned Pipeline / Techniques / T0129

T0129 · Initial Access · TA03 · observed in 45 incident(s)

Typosquatting

Container Security Open Source Security CI/CD Posture

Typosquatting is an attack technique where an attacker creates a package or container with a name that is very similar to a legitimate one, in hopes that a user will make a typo and download the malicious package or container.
For example, if a legitimate package is named "numpy," an attacker might create a package named "numpyy" or "numpi" in hopes that a user will accidentally install the malicious package instead.
In container security, it involves creating a container image with a similar name to a legitimate one, while in open-source security, it involves creating a malicious package with a similar name to a legitimate one.
Once the user installs the malicious package or container, the attacker can potentially gain access to the user's system or data, or inject malicious code into the user's environment.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

Sub-techniques

Mitigations

Detections

Observed in incidents (45)

References