Poisoned Pipeline / Techniques / T0157
Combosquatting
Container Security Open Source Security
Combosquatting is an attack technique where an attacker tries to impersonate legitimate open source packages by adding (or often appending) common words, terms, or letters to the authentic package or image name.
For example, there is popular JavaScript package "lodash" and an attacker may create a package with name "lodashs".
The goal of this attack technique is to trick users into unknowingly downloading and using these fake packages or images, which may contain malicious code, vulnerabilities, or other security risks.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1200 Verify package authenticity
- M1290 Double-checking package or container names
- M1291 Verify package or container sources
- M1500 Verify third-party artifacts and open-source libraries
- M1502 Define trusted package managers and repositories
- M1503 Implement SCA analysis
- M1590 Implement artifact signing and verification
Detections
- D1260 Implement regular security audit and review
- D1262 Implement vulnerability assessment
- D1500 Configure monitoring of used artifacts and open-source libraries
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.