Characterizing Build Compromises Through Vulnerability Disclosure Analysis
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918183432093696 |
|---|---|
| author | Diao, Maimouna Tamah Diouf, Moustapha Awwalou Olatunji, Iyiola Emmanuel Kaboré, Abdoul Kader Mendy, Gervais Klein, Jacques Bissyandé, Tegawendé F. |
| author_facet | Diao, Maimouna Tamah Diouf, Moustapha Awwalou Olatunji, Iyiola Emmanuel Kaboré, Abdoul Kader Mendy, Gervais Klein, Jacques Bissyandé, Tegawendé F. |
| contents | The software build process transforms source code into deployable artifacts, representing a critical yet vulnerable stage in software development. Build infrastructure security poses unique challenges: the complexity of multi-component systems (source code, dependencies, build tools), the difficulty of detecting intrusions during compilation, and prevalent build non-determinism that masks malicious modifications. Despite these risks, the security community lacks a systematic understanding of build-specific attack vectors, hindering effective defense design.
This paper presents an empirically-derived taxonomy of attack vectors targeting the build process, constructed through a large-scale CVE mining (of 621 vulnerability disclosures from the NVD database). We categorize attack vectors by their injection points across the build pipeline, from source code manipulation to compiler compromise. To validate our taxonomy, we analyzed 168 documented software supply chain attacks, identifying 40 incidents specifically targeting build phases. Our analysis reveals that 23.8\% of supply chain attacks exploit build vulnerabilities, with dependency confusion and build script injection representing the most prevalent vectors.
Dataset available at: https://anonymous.4open.science/r/Taxonomizing-Build-Attacks-8BB0. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2511_01395 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Characterizing Build Compromises Through Vulnerability Disclosure Analysis Diao, Maimouna Tamah Diouf, Moustapha Awwalou Olatunji, Iyiola Emmanuel Kaboré, Abdoul Kader Mendy, Gervais Klein, Jacques Bissyandé, Tegawendé F. Software Engineering The software build process transforms source code into deployable artifacts, representing a critical yet vulnerable stage in software development. Build infrastructure security poses unique challenges: the complexity of multi-component systems (source code, dependencies, build tools), the difficulty of detecting intrusions during compilation, and prevalent build non-determinism that masks malicious modifications. Despite these risks, the security community lacks a systematic understanding of build-specific attack vectors, hindering effective defense design. This paper presents an empirically-derived taxonomy of attack vectors targeting the build process, constructed through a large-scale CVE mining (of 621 vulnerability disclosures from the NVD database). We categorize attack vectors by their injection points across the build pipeline, from source code manipulation to compiler compromise. To validate our taxonomy, we analyzed 168 documented software supply chain attacks, identifying 40 incidents specifically targeting build phases. Our analysis reveals that 23.8\% of supply chain attacks exploit build vulnerabilities, with dependency confusion and build script injection representing the most prevalent vectors. Dataset available at: https://anonymous.4open.science/r/Taxonomizing-Build-Attacks-8BB0. |
| title | Characterizing Build Compromises Through Vulnerability Disclosure Analysis |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2511.01395 |