Supply Chain Threats
🌟 Objective
Identify the main attack vectors in the software supply chain, with an emphasis on external dependencies, and establish effective technical and organisational countermeasures.
⚠️ Supply chain attacks are among the most critical today, because they exploit the implicit trust in third-party packages used at build time or runtime.
🔧 Common types of attack
| Threat Type | Description | Real example |
|---|---|---|
| Typosquatting | Package with a name similar to that of a well-known one | lodashs instead of lodash |
| Dependency Confusion | Resolving packages from the public registry instead of the private one | internal-lib published externally |
| Account hijack | Compromised dev account publishes a malicious update | ua-parser-js (2021) |
| Abandoned package | Unmaintained library used as a vector | event-stream (2018) |
| Code Injection | Malicious payload in the postinstall or script | node-ipc (2022) |
🔐 Mitigation strategies
1. Origin verification
- Use internal repositories, proxies or mirrors
- Block the installation of packages from outside an approved origin
2. Name monitoring
- Audit new packages added to
package.json,pom.xml, etc. - Use typosquatting alerts with tools (e.g. Socket.dev, npm-proxy-check)
3. Review of embedded scripts
- Detect
postinstall,preinstall,installwith executable scripts - Use flags such as
--ignore-scriptswhere appropriate
4. Approval and timeout policies
- Require review of new packages before use
- Apply a TTL to abandoned dependencies
5. Build isolation and validation
- Use clean and immutable environments for the build
- Sign artefacts and validate integrity
📖 Case studies
event-stream
- Popular npm package with access transferred
- An update introduced the
flatmap-streamdependency containing malware - Affected financial applications
ua-parser-js
- Hijack of the maintainer's npm account
- Version published with a cryptocurrency miner
- Detected by the community via GitHub Actions
✅ Operational recommendations
| Practice | Apply in |
|---|---|
| Internal proxy with an origin allowlist | All projects |
| Formal approval of new packages | L2 and L3 |
| Scan for malicious scripts in packages | L2 and L3 |
| TTL for dependencies that are not updated | L2 and L3 |
| Alerts for typosquatting and suspicious names | L3 (high) |
🔗 Links to other files
| Document | Link with the supply chain |
|---|---|
03-governanca-libs-terceiros.md | Approval of suspicious or risky packages |
04-integracao-ci-cd.md | Execution of validators and blocking scripts |
07-controle-registos-origem.md | Reinforcement of trusted origin and internal mirrors |
🚫 Control of the supply chain is inseparable from modern security. Ignoring it means blindly trusting code executed outside the organisation's control.