Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Initial Access/ T1195.001

T1195.001Compromise Software Dependencies and Development Tools

T1195.001 — Compromise Software Dependencies and Development Tools is a MITRE ATT&CK technique in the Initial Access tactic. Clankerusecase tracks 58 detection use cases covering it and 40 threat-intel articles citing it.

Initial Access
View on the matrix → Filter Detection Library MITRE official spec ↗
58Use cases
40Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1195 · Supply Chain Compromise

Use cases covering this technique (58)

GitHub Dependabot Alert ESCU actions · hunting P GitHub Pull Request from Unknown User ESCU actions · hunting P [LLM] Install/import of compromised @joyfill 2773 beta package versions Bespoke delivery · alerting DSΣPDDCS [LLM] Vulnerable @hypequery/clickhouse dependency present (< 2.0.2, CVE-2026-54658) Bespoke exploit · hunting DSΣPDDCS [LLM] Vulnerable @prompty/core package present in node_modules (GHSA-w28w-gp39-m4p6 exposure) Bespoke delivery · hunting DSΣPDDCS [LLM] `kiota info` run against a remote/untrusted OpenAPI description (CVE-2026-59865) Bespoke exploit · hunting DSΣPDDCS [LLM] Microsoft Kiota APIPlugin manifest generation from OpenAPI spec (CVE-2026-59864) Bespoke weapon · hunting DSΣPDDCS [LLM] Kiota-generated *-apiplugin.json manifest written to disk (CVE-2026-59864 artifact) Bespoke delivery · hunting DSΣPDDCS [LLM] Vulnerable @sigstore/oci (<=0.7.0) installed into node_modules — incl. transitive deps (CVE-2026-59891) Bespoke delivery · hunting DSΣPDDCS [LLM] Ruby/gem process downloading payload from git.disroot.org (SleeperGem) Bespoke delivery · alerting DSΣPDDCS [LLM] SleeperGem malicious gem artifacts written to gems path (git_credential_manager / Dendreo / fastlane-plugin) Bespoke delivery · alerting DSΣPDDCS [LLM] Compromised @velora-dex/sdk npm package (9.4.1/9.4.2) installed on CI runner Bespoke delivery · alerting DSΣPDDCS [LLM] Malicious startup-module tiddler (.js.tid) written into a TiddlyWiki tiddlers/ directory Bespoke delivery · hunting DSΣPDDCS [LLM] SSH authorized_keys written by non-SSH tooling (symlink repo payload) Bespoke install · hunting DSΣPDDCS [LLM] Git-spawned hook execution during recursive clone (CVE-2024-32002) Bespoke exploit · alerting DSΣPDDCS [LLM] Vulnerable Zcash node software present (CVE-2026-54496 / pre-NU6.2 zcashd & zebrad) Bespoke exploit · alerting DSP [LLM] Execution of unpatched Zcash node binary (zebrad / zcashd / zcash-cli) Bespoke exploit · hunting DSΣPDDCS [LLM] Vulnerable halo2_gadgets / orchard / zcash_primitives crate unpacked in cargo dirs Bespoke delivery · hunting DSPCS [LLM] Vulnerable @xhmikosr/decompress or decompress package present (CVE-2026-53486) Bespoke weapon · hunting DS [LLM] GitHub Actions runner outbound to gist.githubusercontent.com (tj-actions/changed-files CVE-2025-30066) Bespoke c2 · hunting DSΣPDDCS [LLM] tj-actions/changed-files malicious commit 0e58ed86 referenced on host (CVE-2025-30066) Bespoke delivery · alerting DSΣPDDCS [LLM] easy-day-js second-stage C2 beacon to Mastra supply-chain infrastructure Bespoke c2 · hunting DSΣPDDCS [LLM] npm/node postinstall script spawning a download or shell process (Mastra dropper pattern) Bespoke install · hunting DSΣPDDCS [LLM] Malicious easy-day-js typosquat package written into node_modules Bespoke delivery · alerting DSΣPDDCS [LLM] Package-manager dropper self-deletion inside node_modules (evidence erasure) Bespoke actions · hunting DSΣPDDCS [LLM] Known-malicious Mastra supply-chain payload file hashes on disk or in execution Bespoke install · hunting DSΣPDDCS [LLM] Malicious index.js dropped into codfish/semantic-release-action runner checkout Bespoke delivery · hunting DSΣPDDCS [LLM] Bun runtime executing payload index.js from semantic-release-action path Bespoke install · alerting DSΣPDDCS [LLM] Bun runtime executing codfish/semantic-release-action index.js payload on CI runner Bespoke install · alerting DSΣPDDCS [LLM] Known Miasma index.js payload hash present on CI runner (codfish action) Bespoke delivery · alerting DS [LLM] AUR build pulls malicious npm/Bun dependency (atomic-lockfile / js-digest / lockfile-js) Bespoke delivery · alerting DSΣPDDCS [LLM] Package-manager supply-chain control bypass via pnpm minimumReleaseAge=0 Bespoke install · alerting DSΣPDDCS [LLM] Rust build script harvesting git commit diff (onering build.rs) Bespoke actions · alerting DSΣPDDCS [LLM] Rust build script making outbound network connection (build-time exfil) Bespoke c2 · hunting DSΣPDDCS [LLM] Suspicious commit pattern: '[skip ci]' with backdated timestamp adding only IDE config files Bespoke delivery · hunting DSPDD [LLM] Compromised Nx Console VS Code extension (nrwl.angular-console v18.94.0/18.95.0/18.100.0) install on endpoint Bespoke delivery · alerting DSΣPDDCS [LLM] Shai-Hulud style repository poisoning — .claude/router_runtime.js drop Bespoke actions · alerting DSΣPDD [LLM] Context.ai compromised Chrome extension (ID omddlmnhcofjbnbflmjginpjjblphbgk) present on endpoint Bespoke delivery · alerting DSΣPDDCS [LLM] Compromised kubernetes.el destructive payload — Emacs spawning `rm -rf / --no-preserve-root` Bespoke actions · alerting DSΣPDD [LLM] npm install referencing GitHub commit SHA (github:owner/repo#sha) — dangling-commit supply chain hunt Bespoke weapon · hunting DSΣPDDCS [LLM] Ultralytics PyPI supply-chain XMRig coinminer execution from /tmp/ultralytics_runner Bespoke actions · alerting DSΣPDDCS [LLM] SKILL.md file written referencing fabricated openclaw-core prerequisite (ClawHub skill social engineering hook) Bespoke weapon · hunting DSPDDCS [LLM] GitPython CVE-2022-24439 RCE — git 'ext::sh' transport command injection via crafted clone URL Bespoke exploit · alerting DSΣPDDCS [LLM] Lockfile injection: npm/yarn fetching dependencies from GitHub gist/repo instead of the registry Bespoke delivery · hunting DSΣPDDCS [LLM] Vulnerable node-ipc / peacenotwar package present (CVE-2022-23812) Bespoke delivery · alerting DSP [LLM] npm/yarn install spawning anomalous shell or working-dir binary (.npmrc/.yarnrc config override RCE) Bespoke exploit · hunting DSΣPDDCS [LLM] File dropped with invisible Unicode in its name (Hangul Filler U+3164 masquerading) Bespoke weapon · alerting DSΣPDDCS [LLM] Install/resolution of sabotaged npm packages colors@1.4.1/1.4.2/liberty-2 or faker@6.6.6 Bespoke delivery · alerting DSΣPDDCS [LLM] Vulnerable Maven (<3.8.1) invocation revealed by build classpath — CVE-2021-26291 Bespoke exploit · hunting DSPDDCS [LLM] Maven fetching dependencies over cleartext HTTP (MITM-exposed artifact download) — CVE-2021-26291 Bespoke delivery · hunting DSPDDCS [LLM] Vulnerable Grunt < 1.3.0 exposed to YAML deserialization ACE (CVE-2020-7729) Bespoke exploit · hunting DS [LLM] Installation of malicious npm package 'browser-redirect' (supply-chain backdoor) Bespoke delivery · hunting DSΣPDDCS [LLM] npm/yarn dependency fetched from non-registry source (lockfile resolved-URL hijack) Bespoke delivery · hunting DSΣPDDCS [LLM] Ruby/Rails process fetching remote code from pastebin.com raw (rest-client 1.6.13 backdoor) Bespoke c2 · alerting DSΣPCS [LLM] strong_password 0.0.7 backdoor: Ruby app server fetches second-stage payload from pastebin.com/raw/xa456PFt Bespoke c2 · alerting DSΣPCS [LLM] Agama wallet C2/exfil callback to updatecheck.herokuapp.com (electron-native-notify) Bespoke c2 · alerting DSΣPDDCS [LLM] Malicious npm package electron-native-notify present in node_modules Bespoke install · alerting DSΣPDDCS [LLM] Malicious flatmap-stream npm package present in node_modules (event-stream supply-chain backdoor) Bespoke delivery · alerting DSΣPDDCS

Articles citing this technique (40)

crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-30
crit [GHSA / CRITICAL] CVE-2026-54658: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution art-34
crit [GHSA / CRITICAL] GHSA-w28w-gp39-m4p6: Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Render art-90
crit [GHSA / CRITICAL] CVE-2026-59865: Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` art-93
crit [GHSA / CRITICAL] CVE-2026-59864: Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions art-94
crit [GHSA / CRITICAL] CVE-2026-59891: Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry art-129
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-141
high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-159
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-174
crit Symlinks Are Still Scary (And Yes, You Can Commit Them to Git) art-218
crit [GHSA / CRITICAL] CVE-2026-54496: Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrain art-235
crit [GHSA / CRITICAL] CVE-2026-53486: Decompress: Archive extraction can create files and links outside of the target directory art-239
high StepSecurity Maintained Actions Are Now Free for Public Repos art-252
crit Secure Registry now tells you which machine pulled a compromised package art-271
high codfish/semantic-release-action GitHub Action has been compromised art-276
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-299
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-316
high 5 Socket security alternatives and why they are better art-337
crit Compromised Rust crate onering performs code exfiltration art-346
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-406
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
high It's time to treat browser extensions like supply chain attack vectors art-477
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-594
high How “Clinejection” Turned an AI Bot into a Supply Chain Attack art-628
high 2024 in Review: The Evolution of CI/CD Security & What's Next art-641
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-664
crit Snyk’s Fetch the Flag CTF is More Than Just a CTF art-1061
crit NPM security: preventing supply chain attacks art-1929
high Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine art-2459
high Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters art-2597
crit Open source maintainer pulls the plug on npm packages colors and faker, now what? art-2709
high Why you should upgrade to Maven version 3.8.1 art-3121
crit Arbitrary code execution in Grunt art-3298
high What is a backdoor? Let’s build one with Node.js art-3398
high Why npm lockfiles can be a security blindspot for injecting malicious modules art-3476
high Code execution back door found in Ruby’s rest-client library art-3486
crit Concerns of supply-chain attacks amplify as remote code execution was found in Ruby gem strong_password art-3506
high Yet another malicious package found in npm, targeting cryptocurrency wallets art-3510
high A post-mortem of the malicious event-stream backdoor art-3584