Supply Chain Attack

Also Known As

TL;DR

Explanation

Supply chain attacks target the weakest link in the software delivery pipeline — a compromised open-source package, a hijacked build server, or a malicious code commit to a widely-used library can affect thousands of downstream applications simultaneously. Mitigations include pinning dependency versions with integrity hashes (composer.lock with hash verification), auditing packages before adoption, using tools like composer audit, and monitoring for unexpected outbound network connections.

Common Misconception

Why It Matters

Common Mistakes

• Not committing composer.lock to version control — running composer install without it installs unpinned latest versions.
• Not running composer audit or npm audit in CI pipelines to catch known vulnerable dependencies.
• Installing packages from unverified sources or using package name typosquatting targets.
• Running post-install scripts from packages without reviewing them — a common malware vector.

Avoid When

• Never use composer update in production deployments — use composer install --no-dev from the locked file.
• Do not install packages from unknown vendors without reviewing the package source and history on packagist.org.

When To Use

• Pin exact dependency versions in composer.lock and commit it — ensures repeatable builds.
• Run composer audit in CI to catch known-vulnerable dependencies before deployment.

Code Examples

// No version pinning — installs whatever is current
"require": {"acme/payment": "*"}

// Pin versions + commit composer.lock
"require": {"acme/payment": "^2.4.1"}

// Audit on every CI run:
$ composer audit

// Block known-vulnerable packages automatically:
$ composer require --dev roave/security-advisories:dev-latest

// Review before adding new dependencies:
$ composer show acme/payment  // inspect maintainers, abandoned status

// Verify signatures (Composer 2.4+):
$ composer config audit.abandoned report

References

• ↗ https://owasp.org/www-project-web-security-testing-guide/
• ↗ https://getcomposer.org/doc/01-basic-usage.md#commit-your-composer-lock-file-to-version-control

Tags

Related Terms