StarJacking – Making Your New Open Source Package Popular in a Snap
StarJacking is a technique where attackers make malicious open-source packages appear popular.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
ChainJacking github.com
Find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack.
-
Can You Trust Your VSCode Extensions? aquasec.com
Impersonate popular VSCode extensions and trick unknowing developers into downloading them.
-
Introducing MavenGate: a supply chain attack method for Java and Android applications blog.oversecured.com
Many public and popular libraries that have long been abandoned are still being used in huge projects. Access to projects can be hijacked through domain name purchases.
-
How We Hacked a Software Supply Chain for $50K landh.tech
Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.
-
Hijacking GitHub runners to compromise the organization synacktiv.com
Registering a GitHub runner with the ubuntu-latest tag grants access to jobs originally designated for GitHub-provisioned runners.
-
packj github.com
Packj (pronounced package) is a command line (CLI) tool to vet open-source software packages for "risky" attributes that make them vulnerable to supply chain attacks. This is the tool behind our large-scale security analysis platform Packj.dev that continuously vets packages…
CI/CD Attacks › Techniques > Defense Evasion: “StarJacking is a technique where attackers make malicious open-source packages appear popular.”