Supply Chain Attack

CriticalNetwork & InfrastructureA06:2021 – Vulnerable and Outdated Components / A08:2021 – Software and Data Integrity Failures

Attackers compromise third-party dependencies, build pipelines, or software distribution channels to inject malicious code that executes in downstream environments.

Immediate Response

1Pin all dependency versions and audit the full dependency tree for unexpected changes.
2Regenerate all build artifacts from scratch using known-good source code.
3Revoke and rotate any secrets that may have been exposed to the compromised pipeline.
4Isolate affected builds and deployments from production.

All playbooks

1Lock dependency versions with lock files (package-lock.json, yarn.lock, Pipfile.lock).
2Verify package integrity using checksums and Subresource Integrity (SRI) for CDN assets.
3Use a private package registry with vetted packages for all internal dependencies.
4Apply least-privilege principles to CI/CD pipeline credentials and secrets.

Long-term Prevention

1Implement Software Composition Analysis (SCA) scanning on every build.
2Generate and maintain a Software Bill of Materials (SBOM) for all releases.
3Use signed commits and enforce pipeline integrity with code signing.
4Subscribe to security advisories for all critical dependencies.

Attack vectors

Typosquatting: publishing a malicious package with a name similar to a popular one
Compromising maintainer accounts of legitimate packages
Injecting malicious code into CI/CD pipelines (pipeline poisoning)
Dependency confusion attacks using internal package names in public registries

Indicators of compromise

Unexpected external network connections from build or deployment processes
New or modified packages not corresponding to recent development activity
Checksums or hashes of installed packages not matching expected values
Unusual processes or scripts executing during application startup

Tooling

DependabotSnykSocket.devSLSA FrameworkSigstore