Poisoned Pipeline / Techniques / T0164
Inject malicious dependency to privileged user repository
Open Source Security SCM Posture
Injecting a malicious dependency into a privileged user repository is a software supply chain attack where an attacker adds malicious code to a legitimate open-source library or package used as a dependency by a privileged user repository.
By doing so, they can gain access to the privileged resources or data associated with the repository and execute arbitrary code with elevated privileges.
Where this idea came from
arrayref/proc-macro1 injected a build-time dependency into privileged maintainer repos (arrayref in 35% of environments); OWASP CICD-SEC-3 names the pattern.
- https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
- https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-03-Dependency-Chain-Abuse
Mitigations
- M1500 Verify third-party artifacts and open-source libraries
- M1502 Define trusted package managers and repositories
- M1503 Implement SCA analysis
- M1591 Validate dependencies
- M1732 Implement code scanning for security risks
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware