Lion Cipher Lab
Find where malice entered the software chain: compare the clean and the compromised package
- Digital Forensics & IR (DFIR)
- Advanced
- ~50 min
- Free · no account required
Why it matters
Modern software is assembled, not written — a single app pulls in hundreds of packages, each of which pulls in more, and every one of them runs code on your build machine the moment you install it. Attackers noticed. Instead of breaking into you, they poison something you already trust and let your own build pipeline carry the malware in. The two headline shapes — a hijacked open-source dependency (typosquatted or maintainer-account takeover) and a trojanized vendor update (the SolarWinds pattern) — have burned major companies and governments alike. When it happens to you, the whole…
What you'll learn
- reading a clean-vs-compromised package diff to locate the injection point
- recognizing an added install hook (postinstall) as install-time code execution
- using a broken signature / hash mismatch as the integrity-failure signal
- identifying the update/install mechanism as the delivery vector
- reading install-time network artifacts (DNS + HTTP callback) and the timing tell
- distinguishing a compromised dependency (typosquat / hijacked maintainer) from a trojanized vendor update (SolarWinds-style)
- mapping the findings to MITRE ATT&CK T1195, T1195.001 and T1195.002
- judgment: when a diff + integrity check pinpoints the injection vs when you must trace the whole dependency tree
Steps in this lab
- The scenario, and the chair you're sitting in
- Artifact 1 — the diff: clean 2.4.1 vs compromised 2.4.2
- Artifact 2 — the integrity failure: a broken signature and a hash that doesn't reproduce
- Artifact 3 — the delivery vector: the update mechanism carried it in
- Artifact 4 — the network callback, and its damning timing tell
- Two shapes of the same attack: hijacked dependency vs trojanized vendor update
- Map the whole chain to MITRE ATT&CK
- The third rule — WHEN a diff pinpoints it, WHY reproducible builds are the defense, HOW a pro works