Malicious artifact execution

Artifact Security Open Source Security CI/CD Posture

Malicious artifact execution refers to an attack where an attacker injects or modifies a software component with malicious code that is executed when the component is used by a downstream system in the CI/CD process.
When a CI/CD process lacks sufficient mechanisms to validate the integrity of code and artifacts, attackers can insert malicious code that appears to be harmless.
This allows the malicious code to pass through the pipeline undetected, potentially causing harm in the CI/CD process or in production.
The malicious code can be executed in the CI/CD process or even in production.

Where this idea came from

Public incident / advisory

Taken from a public incident, vendor advisory, or first-party write-up cited below.

Mitigations

M1590 Implement artifact signing and verification
M1591 Validate dependencies
M1660 Isolate pipeline for unreviewed code
M1662 Evaluate pipeline execution permissions

Detections

D1510 Implement Intrusion Detection System and anti-malware
D1590 Implement continuous monitoring and logging of the CI/CD process

Malicious artifact execution

Where this idea came from

Mitigations

Detections

Observed in incidents (60)

References