Poisoned Pipeline / Techniques / T0195
Spoofed Commits
SCM Posture
By modifying metadata in commits, attackers can easily push their own code to code repositories. For example, by changing the name and email in a commit it is possible to pass as a legitimate user.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1731 Implement verification of signed commits
Detections
None linked yet.
Observed in incidents (10)
- Forged and timestamp-cloned commits planted a preinstall dropper in hugo-paper and mevn-cli
- tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
- codfish/semantic-release-action tag hijack (Miasma)
- php.net git server Zerodium backdoor
- Spoofed Dependabot commits and secret-stealing Actions
- testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
- Graphalgo spreads to Terraform providers and Go modules
- Neutralinojs org force-push (DPRK / PolinRider)
- PolinRider (DPRK) Git-to-registry jump
- CNCF Antrea Jenkins slash-command credential theft