Skip to content

T1474.001 Compromise Software Dependencies and Development Tools

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.1

Item Value
ID T1474.001
Sub-techniques T1474.001, T1474.002, T1474.003
Tactics TA0027
Platforms Android, iOS
Version 1.1
Created 28 March 2022
Last Modified 20 March 2023

Procedure Examples

ID Name Description
S0297 XcodeGhost XcodeGhost was injected into apps by a modified version of Xcode (Apple’s software development tool).23


ID Mitigation Description
M1013 Application Developer Guidance Application developers should be cautious when selecting third-party libraries to integrate into their application.


ID Data Source Data Component
DS0041 Application Vetting API Calls