Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise

MITRE Techniques

• [T1195.001 ] Compromise Software Dependencies and Development Tools – Used to compromise code repositories, software dependencies, and developer tools in open source supply chain attacks (‘compromise of code repositories, software dependencies and developer tools’).
• [T1195.002 ] Compromise Software Supply Chain – Describes manipulation of source code or update/distribution mechanisms in traditional supply chain compromise (‘manipulation of source code or update/distribution mechanisms’).
• [T1195.001 ] Compromise Software Dependencies and Development Tools – UNC6780 abused the pull_request_target GitHub Actions trigger to access secrets and write permissions (‘abuse of the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions’).
• [T1566.002 ] Spearphishing Link – The axios maintainer account was compromised through social engineering, leading to malicious package publication (‘the maintainer account was compromised via social engineering’).
• [T1021 ] Remote Services – UNC4899 used social engineering to gain access to a developer machine and then operated within the victim environment to inject malicious code (‘compromise a developer’s machine’).
• [T1059.004 ] Unix Shell – The article advises on detecting shell-escape characters and command-substitution patterns in untrusted input, indicating shell-based abuse paths (‘shell-escape characters or command-substitution patterns’).
• [T1105 ] Ingress Tool Transfer – Malicious packages and droppers such as the axios dependency and SLICKDEMON/BADFALL delivered payloads into victim environments (‘deploy the WAVESHAPER.V2 backdoor’, ‘deliver the shellcoded loader BADFALL’).
• [T1218 ] System Binary Proxy Execution – The article discusses malicious install scripts and package execution abuse via npm/pnpm lifecycle behavior (‘disable the automatic running of package install scripts’).
• [T1552 ] Unsecured Credentials – UNC6780 deployed credential stealers and the article focuses on token theft, static keys, and leaked credentials (‘deploy credential stealers’, ‘harvest credentials’).
• [T1098 ] Account Manipulation – Package registry maintainer accounts were taken over and used to publish malicious code (‘the maintainer account was compromised and used to publish the updated versions’).
• [T1190 ] Exploit Public-Facing Application – Consumer-facing websites were compromised to serve ClickFix lures and web skimmers (‘automotive dealership websites served ClickFix lures’, ‘eCommerce websites were infected with web skimmers’).