Poisoned Pipeline / Techniques / T0152
IDE
Open Source Security
Malicious code can be injected into build commands, build scripts or project files.
These commands and scripts can be executed upon IDE project build and run.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report. DEF CON 31: malicious Visual Studio projects and Workspace Trust (Chauchefoin/Gerste).
- https://www.trendmicro.com/en_us/research/23/a/attacking-the-supply-chain-developer.html
- https://defcon.org/html/defcon-31/dc-31-speakers.html#Chauchefoin
Mitigations
- M1500 Verify third-party artifacts and open-source libraries
- M1502 Define trusted package managers and repositories
- M1503 Implement SCA analysis
- M1520 Use security scanning tools
- M1521 Use containerization
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
Observed in incidents (5)
- actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- Hijacked AI coding assistant spreads Shai-Hulud
- DPRK VS Code dictionary and tasks.json droppers
- TanStack Mini Shai-Hulud (CVE-2026-45321)