CAPEC-538 Open-Source Library Manipulation

abstraction: detailedstatus: active

Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.

likelihood: Lowseverity: High

weaknesses (2)

The CWE weakness classes this flaw belongs to.

CWE-494Download of Code Without Integrity Check
CWE-829Inclusion of Functionality from Untrusted Control Sphere

ATT&CK techniques

ATT&CK techniques this enables or maps to.

T1195.001Compromise Software Dependencies and Development Tools

related attack patterns (1)

Related entries.

CAPEC-444Development Alteration

source

Where this definition is published.

MITRE CAPEC