Poisoned Pipeline / Techniques / T0206
Forge or omit build provenance
CI/CD Posture Artifact Security SCM Posture
The attacker ships an artifact without truthful provenance — no SBOM, a
forged SLSA attestation, or a provenance document that names the wrong
source repo, builder, or commit. NIST SSDF PS.3.2 and SLSA Build L2+
exist so consumers can reject unofficial builds; forging or skipping that
paperwork is how a SolarWinds-style implant still looks like a legitimate
vendor release. Distinct from malicious code in the artifact (T0191): this
technique is about lying about *how* the artifact was produced.
Where this idea came from
This catalogue, from NIST SSDF PS.3.2 and SLSA build threats (forge/omit provenance).
- https://slsa.dev/spec/v1.0/threats
- https://csrc.nist.gov/pubs/sp/800/218/final
- https://www.cisa.gov/resources-tools/resources/secure-software-development-attestation-form
Mitigations
- M1200 Verify package authenticity
- M1501 Require SBOM from all third-party suppliers
- M1291 Verify package or container sources
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1262 Implement vulnerability assessment
Observed in incidents (7)
- @velora-dex/sdk 9.4.1 build-pipeline backdoor
- TeamPCP DUSTMAKER AI workspace poisoning
- SolarWinds
- Nx s1ngularity (stolen npm token via Actions injection)
- Keyv / Cacheable ChainDrop worm
- GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
- LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader