Poisoned Pipeline / Techniques / T0220
Deliver the payload only after artifact review
The artifact the reviewer reads and the artifact that runs are the same
signed package, but the behaviour is not all in it. A small loader inside
the reviewed code calls an attacker-controlled endpoint for a
configuration object, and the endpoint decides what happens next: it
answers inactive while the package is under review and live afterwards.
Review does read the code, and still approves it. The operator changes
what executes by changing a server response, with no new submission to
the registry or store and nothing for a rescan to catch.
Two realizations. Fetched-later: the payload exists only on the attacker's
server, arrives base64-encoded in the config, and is run with eval or a
main-world script injection. Shipped-but-gated: the payload is inside the
package but its activation is remote. Socket's Phantom wallet impersonator
shipped both a stripped review server that returned an inactive config and
the live drainer backend, with a comment naming the "approval flip".
Distinct from T0109, where the malicious artifact is submitted as it is,
and from T0207, where verification never runs. Here verification runs and
the artifact genuinely is what was reviewed; what review cannot see is the
runtime decision to enable part of it. Mitigation is behavioural rather
than procedural: treat a fetch-then-eval path in a signed artifact as
hostile whatever the endpoint currently returns, re-check the endpoint
after approval, and treat "no data collection" declarations as unverified
claims rather than findings.
Where this idea came from
This catalogue, from the Phantom wallet impersonator on Firefox Add-ons (Socket, 27 October 2026), which shipped a stripped server-review.js that returned an inactive config during Mozilla's review beside the live server.js drainer, and a comment naming the "approval flip".
Mitigations
None linked yet.
Detections
None linked yet.