Applied Cybernetics Group
T1195.001 Compromise Software Dependencies and Development Tools
- Technique
T1195.001- Tactics
- Initial Access
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 2
- Elastic, Splunk
- 9
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1195/001
MITRE description
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by the original owner.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Adversaries may also target the configuration and instruction files consumed by integrated development environments and AI coding agents. Project files such as tasks.json may execute commands when a developer opens or builds a project, while agent skill files (SKILL.md) supply an agent with instructions and resources that it loads on demand and runs with the permissions of the agent process.(Citation: Microsoft - Agent Skills Docs)(Citation: Google Agent Files May 2026)(Citation: CrowdStrike Threat Hunting Report 2026)(Citation: Microsoft Contagious Interview March 2026) To encourage downloads, adversaries may publish these files under benign-appearing or typo-squatted names, upload unmodified copies of the genuine skills first so the listings accumulate installs before the content behind them is weaponized, or may place the malicious instructions in a secondary document that the reviewed entry point references.(Citation: Zenity Skill Supply Chain August 2026)(Citation: ESET Agent Skills March 2026) Because these artifacts are natural language or configuration rather than executable code, they may pass registry screening and signature-based scanning.(Citation: ESET Agent Skills March 2026)(Citation: TrendMicro - OpenClaw Skills Distribute ATMOS) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Socket: LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
Detection coverage
SigmaHQ community rules
Elastic and Splunk rules
- Curl Download Activity from npm Package Install (elastic)
- Network Connection to OAST Domain via Script Interpreter (elastic)
- Package Runtime Secret File Access Followed by IMDS Request (elastic)
- Node.js Pre or Post-Install Script Execution (elastic)
- Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners (elastic)
- GitHub Actions Workflow Modification Blocked (elastic)
- New GitHub Self Hosted Action Runner (elastic)
- Suspicious PowerShell from npm Package Install (elastic)
- Ollama DNS Query to Untrusted Domain (elastic)