Poisoned Pipeline / Techniques / T0216
Wipe developer profile if a stolen token is revoked
After stealing a credential, the attacker installs a local background
service that keeps a copy of that credential and polls the identity
provider. If the provider rejects the credential — the ordinary result
of revocation — the service deletes the developer's home directory or
user profile. The first remediation step is what triggers the wipe.
Distinct from T0149 (delete repositories): the target is the workstation
profile, not the remote repository. Uninstalling the package that
planted the service does not stop a copy that already landed under
the user config directory.
Where this idea came from
This catalogue, from StepSecurity's write-up of tensorlake@0.5.144. gh-token-monitor polls the stolen GitHub token and deletes the home directory or Windows user profile if GitHub rejects it.
Mitigations
None linked yet.
Detections
None linked yet.
Observed in incidents (2)
- tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
- testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked