Poisoned Pipeline / Techniques / T0141
Fake developer reputation (Starjacking)
Third-party package managers, such as Node Package Manager, PyPi, and Yarn, are commonly used for integrating open-source software packages into existing development environments. These package managers provide metadata about the software and often include a link to the package's source code repository to help developers assess the software's reliability. One way developers evaluate the trustworthiness of a package is by checking its popularity, which is typically measured by the number of "Stars" the package has received. However, some package managers do not validate the connection between the package and its source code repository, which leaves them vulnerable to attacks. Malicious actors can manipulate the popularity statistics of a package by associating a popular source code repository URL with a malicious package, leading developers to unwittingly incorporate the malicious code into their development environment.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://thenewstack.io/php-supply-chain-attack-shows-open-sources-virtues-and-vices/
- https://checkmarx.com/blog/starjacking-making-your-new-open-source-package-popular-in-a-snap/
Mitigations
- M1731 Implement verification of signed commits
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
Observed in incidents (5)
- Registry abuse, starjacking, OAST, and LLM-developer targeting
- indexed-btree runtime npm loader
- mathmain / mathsbase encrypted npm RAT (equation trigger)
- crates.io arrayref / proc-macro1 build-time dropper
- Graphalgo spreads to Terraform providers and Go modules