2022-09-29 00:00 +00:00

Alerte pour un CAPEC

Stay informed of any changes for a specific CAPEC.
Alert management


An adversary spoofs software popularity metadata to deceive users into believing that a maliciously provided package is widely used and originates from a trusted source.


Execution Flow

1) Explore

[Identify target] The adversary must first identify a target package whose popularity statistics will be leveraged. This will be a popular and widely used package, as to increase the perceived pedigree of the malicious package.

2) Experiment

[Spoof package popularity] The adversary provides their malicious package to a package manager and uses the source code repository URL identified in Step 1 to spoof the popularity of the package. This malicious package may also closely resemble the legitimate package whose statistics are being utilized.

3) Exploit

[Exploit victims] The adversary infiltrates development environments with the goal of conducting additional attacks.

  • Active: The adversary attempts to trick victims into downloading the malicious package by means such as phishing and social engineering.
  • Passive: The adversary waits for victims to download and leverage the malicious package.


Identification of a popular open-source package whose popularity metadata is to be used for the malicious package.

Skills Required

Ability to provide a package to a package manager and associate a popular package's source code repository URL.


Before downloading open-source packages, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged.
Look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
Reference vulnerability databases to determine if the software contains known vulnerabilities.
Only download open-source packages from reputable package managers.
After downloading open-source packages, ensure integrity values have not changed.
Before executing or incorporating the package, leverage automated testing techniques (e.g., static and dynamic analysis) to determine if the software behaves maliciously.

Related Weaknesses

CWE-ID Weakness Name
CWE-494 Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.



StarJacking – Making Your New Open Source Package Popular in a Snap
Tzachi Zornstein.


Name Organization Date Date Release
CAPEC Content Team The MITRE Corporation 2022-09-29 +00:00
Click on the button to the left (OFF), to authorize the inscription of cookie improving the functionalities of the site. Click on the button to the left (Accept all), to unauthorize the inscription of cookie improving the functionalities of the site.