T1195.001: Compromise Software Dependencies and Development Tools
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.[1][2][3] This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.[4] Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.[5][6][7]
Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.[8] By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise.[9] As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.[10]
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Analyst context for executives and security teams
This technique matters because a trusted dependency, package, or development tool can become the initial access path before software reaches your organization or customers. The business risk is not just malware on one workstation; it is loss of trust in build pipelines, developer environments, package governance, and the evidence leaders rely on to prove software supply chain control.
Executive priority
Treat this as a software supply chain and resilience issue, not only an endpoint malware issue. Leaders should ask whether the organization can identify critical dependencies, restrict unapproved software and package installation, scan for vulnerable or risky components, and produce audit-ready evidence for how development tools and CI/CD dependencies are governed. Priority should be highest where Linux, macOS, or Windows developer workstations and build systems consume open source packages or CI/CD components such as GitHub Actions.
Technical view
ATT&CK places this sub-technique under Supply Chain Compromise for Initial Access across Linux, macOS, and Windows. The supplied relationship context points defenders toward monitoring for manager-driven dependency or developer-tool activity followed by write/install behavior, first-run execution, and egress. SOC and IR teams should validate visibility across package managers, development tooling, repositories, CI/CD runners, build hosts, and developer endpoints. Relationship context also shows use by multiple software entries, including macOS-focused XCSSET and cross-platform malware such as BeaverTail, reinforcing the need to cover developer environments, not only production servers.
Likely telemetry
- Package manager install/update logs for ecosystems such as npm, PyPI/pip, and related dependency tooling where used
- Repository and CI/CD audit logs, including workflow/action changes and dependency references
- Developer workstation and build host process execution telemetry on Linux, macOS, and Windows
- File creation/modification events in project directories, dependency caches, build outputs, and CI/CD workspaces
- Network egress from build tools, package install scripts, CI/CD runners, and newly executed dependencies
Detection direction
- Validate the related detection strategy pattern: dependency manager or development tool activity that writes or installs code, followed by first execution and unexpected outbound communication.
- Tune for the environment’s normal developer behavior; package installation and CI/CD execution are common, so detection should focus on unusual package names, typosquatting/name-confusion indicators, unexpected maintainers or sources, new install scripts, and abnormal egress.
- Correlate endpoint, repository, and CI/CD logs. A package event alone may be benign, while package installation plus credential access, repository changes, or outbound traffic from a build runner is more decision-useful.
- Check blind spots around ephemeral CI/CD runners, unmanaged developer laptops, local package caches, personal access tokens, and third-party actions or dependencies nested beneath approved components.
- Because the official ATT&CK detection field is not provided, local baselining and the supplied DET0009 relationship should drive validation rather than assuming any default coverage.
Mitigation priorities
- Start with Application Developer Guidance: make secure dependency selection, package review, and CI/CD dependency hygiene part of the SDLC.
- Limit software installation so developers and build systems use approved sources and least-privilege installation paths where feasible.
- Use vulnerability and dependency scanning to identify risky, outdated, abandoned, or unexpected components and to support remediation prioritization.
- Keep software and development tools updated, including operating systems, applications, package tooling, and CI/CD components.
- Require governance evidence: approved package sources, dependency inventories, lockfile practices, CI/CD workflow review, and documented exceptions for audit and incident response readiness.
Analyst notes and limits
The object is a sub-technique of T1195 Supply Chain Compromise and is scoped to Initial Access. The official description specifically covers compromised open source dependencies, abandoned package re-registration, typosquatting/name confusion, and CI/CD components such as GitHub Actions. Related mitigations are M1013, M1016, M1033, and M1051. Related software includes XCSSET, BeaverTail, Shai-Hulud, GlassWorm, and Tsundere Botnet, but those relationships should be used as behavioral context rather than proof of exposure in any specific environment.
The official ATT&CK detection text is not provided. This take is based only on the supplied STIX fields, external references, and relationships; it does not establish active exploitation, customer exposure, or guaranteed detection. Actual risk depends on the organization’s development stack, package ecosystems, CI/CD architecture, logging coverage, and dependency governance maturity.
Compromise Software Dependencies and Development Tools
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.[1][2][3] This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.[4] Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.[5][6][7]
Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.[8] By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise.[9] As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.[10]
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1195 | Supply Chain Compromise | This object subtechnique of Supply Chain Compromise. |
Groups, software, and campaigns
S9034: Tsundere Botnet
Tsundere Botnet is a botnet first reported in mid-2025 that is delivered via MSI installer or a PowerShell script. It leverages Node.js and JavaScript for payload delivery and execution, and uses smart contracts on the blockchain to host command and control (C2) addresses. Tsundere Botnet is attributed to a likely Russian-speaking threat actor.
A variant named DinDoor has been linked to MuddyWater operations and uses the Deno runtime for execution rather than Node.js.[1][2][3][4]
S1246: BeaverTail
BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview. BeaverTail has been delivered to victims through code repository sites and has been embedded within malicious attachments.[1][2][3][4]
S9008: Shai-Hulud
Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]
S0658: XCSSET
XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.[1][2][3]
S9010: GlassWorm
GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 6e9534d4fc46… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Trendmicro NPM Compromise
Trendmicro. (2018, November 29). Hacker Infects Node.js Package to Steal from Bitcoin Wallets. Retrieved April 10, 2019.
Open source URL -
[2]
Bitdefender NPM Repositories Compromised 2021
Silviu Stahie. (2021, November 8). Popular NPM Repositories Compromised in Man-in-the-Middle Attack. Retrieved May 22, 2025.
Open source URL -
[3]
MANDVI Malicious npm and PyPI Packages Disguised
MANDVI. (2025, April 22). Malicious npm and PyPI Packages Disguised as Dev Tools to Steal Credentials. Retrieved September 24, 2025.
Open source URL -
[4]
The Hacker News PyPi Revival Hijack 2024
Ravie Lakshmanan. (2024, September 4). Researchers Find Over 22,000 Removed PyPI Packages at Risk of Revival Hijack. Retrieved May 22, 2025.
Open source URL -
[5]
Ahmed Backdoors in Python and NPM Packages
Deeba Ahmed. (2025, June 2). Backdoors in Python and NPM Packages Target Windows and Linux. Retrieved September 24, 2025.
Open source URL -
[6]
Meyer PyPI Supply Chain Attack Uncovered
Darren Meyer. (2025, May 28). PyPI Supply Chain Attack Uncovered: Colorama and Colorizr Name Confusion. Retrieved September 24, 2025.
Open source URL -
[7]
Checkmarx-oss-seo
Yehuda Gelb. (2024, April 10). New Technique to Trick Developers Detected in an Open Source Supply Chain Attack. Retrieved June 18, 2024.
Open source URL -
[8]
Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025
Omer Gilm Aviad Hahami, Asi Greenholts, and Yaron Avital. (2025, March 20). GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment . Retrieved May 22, 2025.
Open source URL -
[9]
OWASP CICD-SEC-4
OWASP. (n.d.). CICD-SEC-4: Poisoned Pipeline Execution (PPE). Retrieved May 22, 2025.
Open source URL -
[10]
Palo Alto Networks GitHub Actions Worm 2023
Asi Greenholts. (2023, September 14). The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree. Retrieved May 22, 2025.
Open source URL -
[11]
mitre-attack T1195.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.