📦 Canary Dependency

Private npm/pip packages that phone home on install.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A private-scoped package (e.g., @yourorg/internal-auth-helper) listed in package.json, requirements.txt, or go.mod that resolves to a DOAR-controlled package registry. If an attacker clones the repo and runs npm install / pip install from outside the corporate network, the package either: - Fails resolution (detectable via registry logs) - Resolves to a public canary package you control that phones home with the installer's IP, hostname, and environment variables

Implementation requirements

Private package registry (npm Enterprise, Artifactory, CodeArtifact)
A canary package published to the private registry with a benign postinstall hook
Optional: Publish a same-named package to public npm/PyPI that beacons (dependency confusion detection)
The postinstall hook should: curl https://doar-trap.internal/d077?host=$(hostname)&user=$(whoami)
OPSEC: Package must have realistic code (not empty). Include a few utility functions that look legitimate
Monitoring: HTTP access logs on the callback endpoint + registry access logs
Rollback: Remove the dependency from manifests and disable the package in your registry.
Upkeep: Keep the package name reserved, in your registry and on the public one, so no one else can claim it. Monthly proof-of-life install.

Technologies

CI/CDApplication

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1213.003 Code Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.003 Code Repositories as an adversary behaviour.
T1195.002 Compromise Software Supply Chain	Initial Access	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1195.002 Compromise Software Supply Chain as an adversary behaviour. The compromise happens upstream.

Evidence

Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents — Bagmar, A.; Saraf, P., arXiv:2607.15143 2026 preprint
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Sreekumar, "RCE via Dependency Confusion" (2024). "Weaponizing Setup Instructions Against AI Coding Agents" (2026 Preprint).