Supply Chain Poisoning
A cyberattack technique that compromises upstream resources in a software supply chain. Attackers inject malicious code or instructions into software packages, open-source repositories, or dependencies, causing downstream users to trigger the attack automatically during normal use. The technique is characterized by a high degree of concealment.
Timeline (last 90 days)
OpenAI points out that offline does not equal secure: insider mistakes, supply chain poisoning, and media introduction still exist, and offline environments must be paired with strict import auditing and access control.
Common mitigation measures for supply chain poisoning include hash and signature verification of imported artifacts, maintaining a private image registry within the isolated zone, source-level auditing of third-party dependencies, and provenance tracking of datasets.
Supply chain poisoning is a residual risk that offline environments cannot fully eliminate, since the frameworks, CUDA drivers, container images, and dataset shards that training depends on all come from outside.
Using lock files with hash verification, setting up internal auditing and delayed adoption strategies for critical dependencies, and performing manual or automated review of new dependency changes can reduce the risk of supply chain poisoning.
Hallucinated dependency refers to a model recommending package names from memory, pointing to non-existent libraries or deprecated forks, and attackers can squat on packages with the same names to carry out supply chain poisoning.
To defend against such attacks, one should examine the publisher and destination (whether the vendor truly publishes from their own domain) rather than merely checking whether the description appears professional.
The common characteristic of supply chain poisoning attacks is that the attacker does not compromise the target system directly but instead contaminates upstream resources on which the target system depends.
Supply chain poisoning can contaminate upstream resources automatically consumed by Agents by embedding prompt injection instructions in the description fields of public npm/PyPI packages or by submitting Pull Requests containing malicious comments to open-source repositories.
All Facts (8)
OpenAI points out that offline does not equal secure: insider mistakes, supply chain poisoning, and media introduction still exist, and offline environments must be paired with strict import auditing and access control.
50%UnverifiedCommon mitigation measures for supply chain poisoning include hash and signature verification of imported artifacts, maintaining a private image registry within the isolated zone, source-level auditing of third-party dependencies, and provenance tracking of datasets.
50%UnverifiedSupply chain poisoning is a residual risk that offline environments cannot fully eliminate, since the frameworks, CUDA drivers, container images, and dataset shards that training depends on all come from outside.
50%UnverifiedUsing lock files with hash verification, setting up internal auditing and delayed adoption strategies for critical dependencies, and performing manual or automated review of new dependency changes can reduce the risk of supply chain poisoning.
50%UnverifiedHallucinated dependency refers to a model recommending package names from memory, pointing to non-existent libraries or deprecated forks, and attackers can squat on packages with the same names to carry out supply chain poisoning.
50%UnverifiedTo defend against such attacks, one should examine the publisher and destination (whether the vendor truly publishes from their own domain) rather than merely checking whether the description appears professional.
50%UnverifiedThe common characteristic of supply chain poisoning attacks is that the attacker does not compromise the target system directly but instead contaminates upstream resources on which the target system depends.
50%UnverifiedSupply chain poisoning can contaminate upstream resources automatically consumed by Agents by embedding prompt injection instructions in the description fields of public npm/PyPI packages or by submitting Pull Requests containing malicious comments to open-source repositories.
50%