Hunting Supply Chain Attacks While Getting Supply Chain Attacked

TL;DR: While building threat intel for Pattern 38 GitHub supply chain attacks, we discovered we had the same class of vulnerability in our own repo. The irony writes itself.

The Setup

Saturday afternoon. We're enriching OTX pulses with medical device CVEs, cross-referencing Stealc/Rhadamanthys C2 infrastructure, feeling pretty good about our threat intel game.

Then someone asks: "Did you check the Dependabot alerts?"

The Discovery

HIGH (4x): glob CLI command injection via -c/--cmd (shell:true)
MEDIUM: body-parser DoS via URL encoding
MEDIUM: js-yaml prototype pollution

Four HIGH severity alerts. In our repo. The `glob` package - a file pattern matcher used by basically every Node.js project - had a command injection vulnerability. And we had it as a transitive dependency in `browser-extractor-service`.

The same class of attack we'd been documenting all week in Pattern 38.

The Irony

• Supply chain attacks via GitHub issue comments

• Trojanized npm packages (MUT-4831)

• Transitive dependency exploitation

And we had a vulnerable transitive dependency sitting in our own `package-lock.json` for 6 days.

The Good News

1. Not deployed - `browser-extractor-service` never made it to production 2. SBOM caught it - Our CycloneDX SBOM generation flagged the vulnerable component 3. Patched same session - 6 PRs merged, 0-day from discovery to fix

The Lesson

You don't know what's in your dependency tree until the CVE drops.

The Pattern 38 victims we're tracking didn't know they had Stealc until their credentials were gone. We didn't know we had `[email protected]` until Dependabot told us.

• SBOMs matter - You can't patch what you can't see

• Dependency scanning is table stakes - Not optional, not "nice to have"

• Transitive dependencies are the attack surface - You probably have 10x more indirect deps than direct ones

The Numbers

| Metric | Value | |--------|-------| | Dwell time (PR created → merged) | 6 days | | Dwell time (discovered → patched) | ~30 minutes | | Production exposure | 0 days (not deployed) | | Transitive dependency depth | 3 levels deep (jsdom → glob) |

The Meta

We're building a platform that helps companies track supply chain threats. Today we proved our own tooling works - our SBOM pipeline caught the vulnerability, Dependabot created the PR, and we patched it.

Eat your own dogfood. Check your own dependencies. The supply chain attack you're hunting might be in your own repo.

---

*This post is part of our ongoing Pattern 38 supply chain attack research. For IOCs and STIX feeds, visit analytics.dugganusa.com/api/v1/stix-feed*

CVE Reference: glob CLI command injection (CVE-2024-XXXXX) - Fixed in [email protected]

MITRE ATT&CK: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain)