Understanding typosquatting methods - for a secure supply chain
Typosquatting involves publishing malicious packages with names similar to legitimate ones, exploiting typos to inject malicious code.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Fixing typos and breaching microsoft's perimeter johnstawinski.com
Bypass GitHub workflow approval requirement by becoming a contributor.
-
PR sneaking github.com
Methods of sneaking malicious code into GitHub pull requests.
-
One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images adnanthekhan.com
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
-
Trojan Source trojansource.codes
Rather than inserting logical bugs, adversaries can attack the encoding of source code files to inject vulnerabilities.
-
GitHub comments abused to push malware via Microsoft repo URLs bleepingcomputer.com
Hidden GitHub comment link.
-
Malicious code analysis: Abusing SAST (mis)configurations to hack CI systems medium.com
Misconfigured SAST tools can be exploited to execute malicious code on CI systems, allowing attackers to steal credentials or deploy malicious artifacts.
CI/CD Attacks › Techniques > Initial Code Execution: “Typosquatting involves publishing malicious packages with names similar to legitimate ones, exploiting typos to inject malicious code.”