Poisoned Pipeline Execution

{
  "id": "ATTACK:enterprise:T1677",
  "title": "Poisoned Pipeline Execution",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1677",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7655ac3b-dfde-49c5-a967-242856174434",
  "external_id": "T1677",
  "domain": "enterprise",
  "created": "2025-05-22T20:01:16.611Z",
  "modified": "2026-05-12T15:12:00.642Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Synactiv Hijacking GitHub Runners",
      "url": "https://www.synacktiv.com/en/publications/hijacking-github-runners-to-compromise-the-organization"
    },
    {
      "source_name": "GitHub Security Lab GitHub Actions Security 2021",
      "url": "https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/"
    },
    {
      "source_name": "GitHub Security Labs GitHub Actions Security Part 2 2021",
      "url": "https://securitylab.github.com/resources/github-actions-untrusted-input/"
    },
    {
      "source_name": "John Stawinski PyTorch Supply Chain Attack 2024",
      "url": "https://johnstawinski.com/2024/01/11/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch/"
    },
    {
      "source_name": "Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025",
      "url": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack"
    },
    {
      "source_name": "OWASP CICD-SEC-4",
      "url": "https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution"
    },
    {
      "source_name": "Wiz Ultralytics AI Library Hijack 2024",
      "url": "https://www.wiz.io/blog/ultralytics-ai-library-hacked-via-github-for-cryptomining"
    }
  ]
}