Typical severity: High. Likelihood of attack: Medium. An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications.
Leverage dedicated package managers instead of directly linking to VCS repositories. | Utilize version pinning and lock files to prevent use of maliciously modified repositories. | Implement "vendoring" (i.e., including third-party dependencies locally) and leverage automated testing techniques (e.g., static analysis) to determine if the software behaves maliciously. | Leverage automated tools, such as Checkmarx's "ChainJacking" tool, to determine susceptibility to Repo Jacking attacks.