Poisoned Pipeline

Poisoned Pipeline / Techniques / T0209

T0209 · Initial Access · TA03 · observed in 29 incident(s)

Compromise package registry or CDN origin

Artifact Security Cloud Security CI/CD Posture

Instead of publishing a malicious version under a stolen maintainer
account, the attacker tampers with the registry or the CDN origin pool
that serves it. Consumers still resolve the real hostname. Coder's
registry.coder.com incident (GHSA-vx42-ghc9-gw65) is the type case:
rogue origin IPs were added to a Cloudflare pool so a legitimate CDN
served stolen-credential Terraform modules. Distinct from T0205 (third-party
web asset) and T0109 (publish to the registry as a user).

Where this idea came from

Public incident / advisory

Coder origin pool, corepack.org, Notepad++; DEF CON 34: “No Socket, No Privs, No Problem: Weaponizing OCI Registries for SSRF, Credential Theft, and Container Escapes” (Rochester/Gould) and “Compounding Interest: Exploiting the ATM Supply Chain” extend registry-origin attacks to OCI and hardware.

Mitigations

Detections

Observed in incidents (29)

References