Poisoned Pipeline / Techniques / T0198
Malicious Build Time Dependencies
CI/CD Posture Code Security Open Source Security
Within the CI/CD workflow, code can be pushed at different stages. During the build process, plugins are often utilized for tasks like building and testing. However, if a third-party plugin is compromised, malicious code can be introduced. For instance, an attacker gains control over a Maven plugin (a popular build framework) and inject malware during the build process. SBOM tools may not be effective in detecting such scenarios as they primarily operate on source code.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1200 Verify package authenticity
- M1220 Use only trusted third-party Github actions from reputable sources
- M1501 Require SBOM from all third-party suppliers
Detections
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (5)
- XZ Utils backdoor
- StubMaker RubyGems (and npm) Windows infostealer
- Forty-two RubyGems from reqthrottle_3474 run a reverse shell or a crypto stealer at install
- crates.io arrayref / proc-macro1 build-time dropper
- Ultralytics PyPI compromise