Poisoned Pipeline / Techniques / T0197
Use code from untrusted source
Open Source Security CI/CD Posture
It is possible to install a package not from an official package repository - but rather install directly using a URL. Packages from official repositories are usually vetted for security vulnerabilities. Installing from an unverified URL can expose your system to malicious software, including viruses, malware, or other security threats.
Where this idea came from
Inherited article citation; conference: DEF CON 34 “Hacking the Hackers who Hack Hackers” (Morag) — operators install FirewallFalcon from GitHub/Telegram, outside a vetted registry, and it ships a backdoor, a rogue TLS root, and DNS hijack.
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66596
- https://www.thirdpartytrust.com/blog/what-is-shadow-it-digital-supply-chain/
- https://www.bleepingcomputer.com/news/security/new-xcodespy-malware-targets-ios-devs-in-supply-chain-attack/
Mitigations
- M1450 Implement zero trust
- M1451 Use network segmentation
- M1503 Implement SCA analysis
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (9)
- GitHub repo jacking (dependency URL takeover)
- PolinRider poisons visanduma/nova-two-factor Packagist via Git
- GoldenSpy backdoor shipped inside bank-mandated tax software
- AppleJeus fake crypto trading apps carried malware from vendor-run sites
- TraderTraitor interview repos point Terraform at a lookalike provider registry
- DPRK Contagious Interview (BeaverTail / npm + git)
- Deep-Live-Cam malicious git dependency
- PolinRider (DPRK) Git-to-registry jump
- RevStealer trojanized Electron apps via fake Claude desktop and cheat sites