Compromising the Developer: How Modern Dependency Culture Reshaped the Supply Chain Threat Landscape

MITRE Techniques

• [T1078 ] Valid Accounts – Attackers used stolen maintainer, CI, or developer credentials to publish malicious packages and republish the worm across victim-maintained packages (‘it harvested developer and CI credentials and used them to republish itself’).
• [T1195 ] Supply Chain Compromise – Adversaries compromised packages, build systems, and extensions to deliver malicious code through trusted channels (‘compromise the developer, the maintainer account, the build pipeline, or the package registry’).
• [T1557 ] Adversary-in-the-Middle – Dependency confusion exploited package resolution trusting the wrong source, enabling code execution through public registry lookups (‘they pull whichever carries the higher version number, even if that means reaching out to the public one’).
• [T1588 ] Obtain Capabilities – Attackers gained privileged access through legitimate contribution paths or stolen tokens before deploying payloads (‘a stolen token let the attacker alter the action’).
• [T1190 ] Exploit Public-Facing Application – Public registries and build systems were abused as externally reachable trust points to inject malicious artifacts (‘the public registry as a delivery channel’).
• [T1059 ] Command and Scripting Interpreter – Malicious extensions and packages executed commands at startup or during install to fetch payloads and dump secrets (‘On startup the extension silently ran a command that fetched a hidden payload’).
• [T1552 ] Unsecured Credentials – Attackers harvested and stole GitHub, npm, cloud, session, and CI secrets from build logs, extensions, and compromised workflows (‘harvested tokens for GitHub, npm and cloud services’).
• [T1036 ] Masquerading – Typosquatted package names and repointed tags were used to hide malicious updates as legitimate ones (‘typosquatted package names, install-time scripts’).
• [T1480 ] Execution Guardrails – The event-stream payload activated only inside the build of a specific Bitcoin wallet, limiting execution to the intended target (‘activated only inside the build of a specific Bitcoin wallet’).
• [T1566 ] Phishing – Consent-phishing and recruiter lures were used to gain access or deliver malicious applications (‘a consent-phishing email tricked a Cyberhaven developer’).
• [T1071 ] Application Layer Protocol – The xz-utils backdoor provided remote-code-execution capability through the release tarball mechanism (‘he hid a remote-code-execution backdoor in the release tarballs’).
• [T1105 ] Ingress Tool Transfer – Malicious packages and extensions fetched hidden payloads from remote sources during execution (‘it silently ran a command that fetched a hidden payload’).
• [T1608 ] Stage Capabilities – Multi-stage loaders and hidden payloads were prepared for later execution in the target environment (‘obfuscated multi-stage loaders’).