Poisoned Pipeline / Techniques / T0207
Skip or forge artifact integrity verification
Artifact Security Open Source Security CI/CD Posture
Consumers are supposed to verify packages, containers, and third-party
scripts (checksums, signatures, Sigstore, Subresource Integrity). The
attacker relies on that check never running, or supplies a matching but
attacker-controlled signature. OWASP CICD-SEC-9 names the control gap;
this technique is the attacker side. Polyfill.io hotlinks without SRI and
unsigned CI helper scripts are typical realizations.
Where this idea came from
Polyfill.io SRI gap, fwupd CVE-2020-10759; DEF CON 34: “LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails” (Donenfeld) — model-based build gates as the new verification boundary.
- https://owasp.org/www-project-top-10-ci-cd-security-risks/
- https://www.w3.org/TR/SRI/
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66588
Mitigations
- M1200 Verify package authenticity
- M1291 Verify package or container sources
- M1090 Implement code and image signing
Detections
- D1090 Implement package or image integrity verification
- D1500 Configure monitoring of used artifacts and open-source libraries
Observed in incidents (8)
- MacSync via signed fake Claude Desktop installers on a lookalike download site
- Polyfill.io CDN takeover
- GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
- Codecov Breach
- UNC7017 swapped AOMEI update config for minutes at a time
- DirtyBlanket fake Express/React packages spread a self-propagating Linux worm
- fwupd dangling S3 bucket and CVE-2020-10759 signature-verification bypass
- Microsoft counterfeit-installer campaign — same-named archives regenerate server-side per download