Broader threat coverage

Currently supported:

• Threats that trigger during build processes and CI/CD (install-time)

  ---

  If a malicious package gets installed during the build, an attacker can perform some of these activities in the context of the build system:

  • Steal code and any hardcoded sensitive data along with it.
  • Plant a backdoor in code to be used after the code is deployed to the production environment.
  • Steal compute resources like CPU, RAM, etc. for activities like crypto mining.
  • Steal environment variables, sensitive files, credentials, certificates, etc.
  • Perform lateral movement and privilege escalation with the data collected.

Future:

• maintainer risk: expiring domains, large changes, no 2FA
• mismatching metadata e.g. shasums, git contexts, etc.