Poisoned Pipeline / Techniques / T0170
Malicious compiler or interpreter
The malicious compiler or interpreter attack is a defense evasion technique where an attacker modifies the software development tools to insert malicious code into the final product.
This allows attackers to bypass security controls and gain access to systems or data.
The attack involves replacing a legitimate compiler or interpreter with a malicious version that can execute malicious instructions or hide the attacker's activities.
This technique is often used to insert backdoors into software and bypass security controls designed to prevent the execution of malicious code.
Where this idea came from
Ken Thompson’s 1983 trusting-trust demo is the original; conference talks formalize compiler-level attacks: Black Hat USA 2026 “Burning Tears of PHP’s Memory Hardening” (engine/interpreter-level exploitation).
- https://jfrog.com/blog/detecting-known-and-unknown-malicious-packages-and-how-they-obfuscate-their-malicious-code/
- https://network-king.net/compiler-flaw-facilitates-supply-chain-attacks/
- https://www.blackhat.com/us-26/briefings/schedule/index.html
- https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
Mitigations
- M1500 Verify third-party artifacts and open-source libraries
- M1502 Define trusted package managers and repositories
- M1590 Implement artifact signing and verification
- M1730 Implement code reviews
- M1731 Implement verification of signed commits
- M1732 Implement code scanning for security risks
Detections
- D1510 Implement Intrusion Detection System and anti-malware