Threat taxonomy
medium activitySupply ChainFirst seen 2024
BuildPipe Squat
Aliases: Registry typosquat campaign
Ongoing publication of malicious lookalike packages for payment, KYC and messaging libraries, aimed at harvesting CI credentials from fintech build systems.
Attribution
Opportunistic criminal actors
Primary targets
- — Fintech engineering teams
- — Integration partners
Observed tactics
- Typosquatting popular package names
- Install-time script execution
- Environment variable exfiltration
Regional relevance
Fast-growing fintech build teams often run unpinned dependencies, making this a low-effort, high-yield path.
Detection guidance
- Pin and lock dependencies with integrity hashes
- Disable install scripts by default in CI
- Alert on outbound network calls during package installation
Related feed reporting
- high09 Sept 2026
Core banking vendor discloses compromise of a remote support tool
- high20 Aug 2026
Open-source payment library typosquat targets fintech build pipelines