Spoof Open-Source Software Metadata
2022-09-29 00:00 +00:00

Alerte pour un CAPEC

Stay informed of any changes for a specific CAPEC.
Alert management


An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.



Identification of a popular open-source component whose metadata is to be spoofed.

Skills Required

Ability to spoof a variety of software metadata to convince victims the source is trusted.


Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged.
Within package managers, look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
Reference vulnerability databases to determine if the software contains known vulnerabilities.
Only download open-source software from reputable hosting sites or package managers.
Only download open-source software that has been adequately signed by the developer(s). For repository commits/tags, look for the "Verified" status and for developers leveraging "Vigilant Mode" (GitHub) or similar modes.
After downloading open-source software, ensure integrity values have not changed.
Before executing or incorporating the software, leverage automated testing techniques (e.g., static and dynamic analysis) to determine if the software behaves maliciously.

Related Weaknesses

CWE-ID Weakness Name
CWE-494 Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.


Name Organization Date Date Release
CAPEC Content Team The MITRE Corporation 2022-09-29 +00:00
Click on the button to the left (OFF), to authorize the inscription of cookie improving the functionalities of the site. Click on the button to the left (Accept all), to unauthorize the inscription of cookie improving the functionalities of the site.