Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Attack Patterns CAPEC-695 — Repo Jacking
CAPEC-695

Repo Jacking

TLP:CLEAR

Description

Typical severity: High. Likelihood of attack: Medium. An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications.

Mitigation

Leverage dedicated package managers instead of directly linking to VCS repositories. | Utilize version pinning and lock files to prevent use of maliciously modified repositories. | Implement "vendoring" (i.e., including third-party dependencies locally) and leverage automated testing techniques (e.g., static analysis) to determine if the software behaves maliciously. | Leverage automated tools, such as Checkmarx's "ChainJacking" tool, to determine susceptibility to Repo Jacking attacks.

Details

Platforms
Social-engineering
Supply-chain
Communications
Software
Hardware
Added
Jul 14, 2026
Leaving Threaticon

This link opens an external site that isn't part of the platform.