Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Limit Software Installation
is blocked by Vulnerability Scanning
is blocked by Update Software
is blocked by Application Developer Guidance
is blocked by Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)
is blocked by Provenance
is blocked by Access Restriction For Change
is blocked by Security, Compliance & Resilience Controls Oversight
is blocked by Secure Baseline Configurations
is blocked by Least Functionality
is blocked by User-Installed Software
is blocked by Continuous Monitoring
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Assessments
is blocked by Secure Software Development Practices (SSDP)
is blocked by Security, Compliance & Resilience Testing Throughout Development
is blocked by Product Tampering and Counterfeiting (PTC)
is blocked by Developer Configuration Management
is blocked by Unsupported Technology Assets, Applications and/or Services (TAAS)
is blocked by Acquisition Strategies, Tools & Methods
is blocked by Threat Hunting
is blocked by Software & Firmware Patching
is blocked by Vulnerability Scanning
Impressum Deutsch Englisch