Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Attack Patterns CAPEC-691 — Spoof Open-Source Software Metadata
CAPEC-691

Spoof Open-Source Software Metadata

TLP:CLEAR

Description

Typical severity: High. Likelihood of attack: Medium. An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.

Mitigation

Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged. | Within package managers, look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference. | Reference vulnerability databases to determine if the software contains known vulnerabilities. | Only download open-source software from reputable hosting sites or package managers. | Only download open-source software that has been adequately signed by the developer(s). For repository commits/tags, look for the "Verified" status and for developers leveraging "Vigilant Mode" (GitHub) or similar modes.

Details

Platforms
Social-engineering
Supply-chain
Software
Added
Jul 14, 2026
Leaving Threaticon

This link opens an external site that isn't part of the platform.