Supply Chain Attack Vectors

It runs whatever that URL returns at that moment, with the caller's full privileges and no version, review or integrity check. Anyone who can write to the hosting location therefore runs code on every laptop and every CI job.

Five different doors. SUNBURST came through a compromised build system, xz-utils through a contributor who earned maintainer trust, event-stream through inherited maintainership, Codecov through a tampered delivery script, and ua-parser-js through a stolen publisher account.

Many package managers let a package declare install hooks, scripts the manager runs automatically as part of installing it. Installing is therefore code execution, not a file copy, and it happens before your tests or scanners ever run.

AI assistants invent plausible package names that were never published. Attackers collect those hallucinated names, register them on the public index, and wait for someone to install one. The name looks right precisely because a model generated it.

A maintainer account takeover is an attacker gaining the credentials or rights that publish a package, then shipping a malicious version under the real identity. A signature proves who published, not that the publisher was honest or still in control.

Protestware is a release the package's own maintainer deliberately sabotages to make a point. A signature proves who published the bytes and an SBOM lists what is inside; neither judges intent.

Both releases were authentic. SUNBURST was signed with the vendor's real key because the code was injected before signing, and ua-parser-js was published from the maintainer's real account. Scanners match published advisories, and no advisory existed yet.

Because when a build consults an internal source and a public one for the same name, precedence is decided by version-selection rules, not by which source is trusted. The highest satisfying version wins, so a huge public version beats the internal one.

Everything the job can reach: injected secrets in the environment, the short-lived credentials behind the deploy role, the source checkout, caches it writes and outbound network. The hook runs before any test, so production access is available to it from the start.

Separation of duties failed on a privileged path: one person authored and approved a change to code that holds production ledger credentials. Independent review of that path, a narrower job identity, and an out-of-band reconciliation are the missing controls.

Internal package names are not secrets. They leak through lock files in public repositories, shipped front-end bundles, container images, stack traces and CI logs. The attacker needs no access to your private index, only the name.

Lockfiles, generated code, vendored directories and binary fixtures. Reviewers approve them because the diff is machine-produced or unreadable, so a change hidden there inherits the trust of reviewed code without anyone having read it.

Because the compiler that does the rebuild is a binary, not its source. A subverted compiler can recognise that it is compiling the compiler and re-insert both the backdoor and the rule that re-inserts it, so the clean source produces a backdoored binary again.

TLS protects the channel to an endpoint; the mirror is the endpoint. It authenticates who you are talking to and stops tampering in transit, but it cannot say whether the files that endpoint holds are the ones the publisher produced.

An sdist is source, so the installer has to build it first, and that build runs the package's own build code. A wheel is already built, so installing it only unpacks files and metadata. The package's code then waits for an import.

Reviewers read names for meaning, not glyph by glyph, and confusable characters render nearly identically: a Cyrillic vowel, a capital I standing in for lowercase l, the pair rn for m. Catching these needs mechanical normalisation, not attention.

A fixture is only data until something interprets it. If a build or test helper reads that file and evaluates, extracts or links what it holds, committing bytes there is committing code — through a diff no reviewer opened.

The attacker volunteers. Over months or years of genuine useful contributions to an overloaded single-maintainer project they are granted commit and release rights, then abuse authority that was given, not taken. No credential is stolen, so no account control fires.

The payload only runs when a host-environment condition matches, so the maintainer's own pipeline and most reviewers' sandboxes execute the benign branch. Review also inspects source, while consumers install a published artifact that need not correspond to it.

Investigate from the artifact backwards, not the repository forwards. Preserve the published bytes, rebuild the tagged source somewhere you control and compare, then enumerate every build step with write access to the output. Treat the builder and its secrets as compromised.

Every job that fetched it ran attacker code with that job's credentials and could alter what the job published, so the reach extends to those artifacts' consumers. Worse, a run-time fetch leaves no dependency record to query.

Point-in-time records, not a fresh scan. You need the exact affected versions and window, the lockfiles at the commits that were built, build and dependency-resolution logs from that window, and the inventory of image digests actually deployed and running.

Because publishing is a separate act from committing. Whoever holds release rights builds and uploads the artifact themselves, and nobody diffs it against the tag, so the shipped release can contain material that never appeared in the reviewed source.

The visible loss is that no fix will ever arrive. The deeper loss is the disclosure channel: nobody remains to receive a report or publish an advisory, so a clean scan means nobody is looking.

Name similarity is a routing signal, not a verdict. Route flagged and never-before-seen names into a quarantine lane where a person decides once, record every decision on an allow-list, and watch for teams bypassing the gate.

Because an import path is a name, not an identity. Resolution asks whoever controls that domain or namespace today for the code, so a lapsed domain bought by a stranger serves their content under the original, unchanged path.

Something stopped the internal source answering for that name — a not-found on a new or transitive requirement, an outage, or a cold cache on a fresh runner — while a public source stayed reachable. Start from the build's resolution log.

Most registries never verify that the repository a package links to actually produced the published archive. Stars, README and badges belong to that repository, so an attacker can point at a popular project and borrow its reputation wholesale.

It tells you that who can publish has changed, which is worth acting on. It tells you little about the person: account age, activity history and profile detail are cheap to manufacture, so treat the change as a trigger, not a verdict.