Artifact Integrity Verification Missing

Detects download and execution of artifacts without cryptographic hash or signature verification.

zakirkun eb9e64a 2 files · 1.9 KB Updated

File contents

Artifact Integrity Verification Missing

Overview

Downloading binary artifacts, scripts, or packages from URLs without verifying their cryptographic signatures or hashes allows man-in-the-middle attacks or compromised CDN attacks to deliver malicious code.

Remediation

  • Always verify SHA256 hash of downloaded artifacts
  • Use --checksum flags where available
  • Use Subresource Integrity (SRI) hashes for CDN resources in HTML
  • Verify GPG signatures for critical software

zakirkun/ice-tea/tree/main/skills/supply-chain/artifact-integrity commit eb9e64a62c

Frequently asked questions

npx skillmds@latest add zakirkun/artifact-integrity-verification-missing