Poisoned Pipeline / Techniques / T0201
Customers compromised
Artifact Security CI/CD Posture Open Source Security
The downstream consequence of a software supply-chain attack: customers who
consumed a poisoned update, package, or service are themselves breached.
SolarWinds Orion, 3CX, Codecov, and Polyfill.io are canonical examples —
the supplier is the delivery vehicle; customer environments are the prize.
Modeling this as its own Impact technique lets defenders map "what happened
to us because we trusted a vendor" without collapsing it into a generic
backdoor label.
Where this idea came from
This catalogue, from upstream issue #84 (Impact: customers compromised).
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-008a
- https://www.mandiant.com/solarwinds-break-resource-center
- https://github.com/pbom-dev/OSCAR/issues/84
Mitigations
- M1200 Verify package authenticity
- M1291 Verify package or container sources
- M1501 Require SBOM from all third-party suppliers
- M1860 Implement strong authentication mechanisms
Detections
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (19)
- Packagist CMS themes delivering iOS spyware
- CCleaner 5.33 signed ShadowPad backdoor
- Team PCP CI/CD secrets campaign
- JuiceStealer PyPI phishing and typosquats
- Polyfill.io CDN takeover
- PyTorch-nightly torchtriton dependency confusion
- SolarWinds
- XZ Utils backdoor
- Rank Math PRO 3.0.123 downloads carried malware that plants a recreating backdoor
- Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
- An attacker accessed Zeabur internal systems and some customer services on 14 October
- axios npm remote-access trojan
- Coder registry CDN origin pool compromise
- Webmin 1.890–1.920 build-server backdoor
- crates.io arrayref / proc-macro1 build-time dropper
- CircleCI December 2022 / January 2023 incident
- TanStack Mini Shai-Hulud (CVE-2026-45321)
- UNC7017 swapped AOMEI update config for minutes at a time
- Brevo Cloudflare Worker ClickFix