Installation scripts

Cloud Security Code Security Open Source Security

A package installation script injection attack is a type of security exploit that involves an attacker injecting malicious code into a legitimate software package installation script.
The attack typically occurs when an attacker gains access to the distribution network of a software vendor or package manager, and injects malicious code into the package installation script.
This code may be designed to carry out a range of nefarious activities, such as stealing sensitive information, creating backdoors, or executing arbitrary code on the victim's system.
Once the victim downloads and installs the compromised software package, the injected code is executed, giving the attacker access to the victim's system.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

Mitigations

M1500 Verify third-party artifacts and open-source libraries
M1502 Define trusted package managers and repositories
M1503 Implement SCA analysis

Detections

D1510 Implement Intrusion Detection System and anti-malware

Installation scripts

Where this idea came from

Mitigations

Detections

Observed in incidents (44)

References