Poisoned Pipeline / Techniques / T0205
Compromise third-party CDN or hosted web asset
Open Source Security Artifact Security Cloud Security
Instead of poisoning a package registry or source repository, the attacker
takes over a widely embedded CDN hostname, tag manager, or hosted JavaScript
asset (domain expiry, registrar hijack, or operator acquisition) and serves
malicious content to every site that loads it. Polyfill.io (2024) is the
reference case: a trusted script URL became a drive-by supply-chain implant
for hundreds of thousands of properties. This catalogue previously had no technique
that named this web-asset supply chain.
Where this idea came from
This catalogue, after Polyfill.io (Sansec) showed CDN/web-asset takeover was unnamed. DEF CON 33: abandoned S3 buckets still referenced by software (Shudrak).
- https://sansec.io/research/polyfill-supply-chain-attack
- https://www.cisa.gov/news-events/alerts/2024/06/27/widespread-security-compromise-polyfillio-supply-chain-attack
- https://defcon.org/html/defcon-33/dc-33-speakers.html#content_60312
Mitigations
- M1200 Verify package authenticity
- M1291 Verify package or container sources
- M1501 Require SBOM from all third-party suppliers
- M1932 Contract a supplier incident-notification clause with a reporting template and SLA
Detections
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (10)
- Operation SignSight trojanized VGCA installers on a government CA's download site
- 24 npm packages abused trusted mirrors to host phishing redirect pages
- MacSync via signed fake Claude Desktop installers on a lookalike download site
- Polyfill.io CDN takeover
- Operation StealthyTrident compromised Able Desktop's update server
- OptinMonster / TrustPulse / PushEngage plugin supply chain
- Placeholder domain third-party.com turned live ClickFix server
- Coder registry CDN origin pool compromise
- DirtyBlanket fake Express/React packages spread a self-propagating Linux worm
- Brevo Cloudflare Worker ClickFix