This vulnerability occurs when build or deployment pipelines fail to verify the authenticity and integrity of artifacts (e.g., binaries, container images, or packages) before promotion or deployment. Attackers may tamper with artifacts in transit or compromise intermediate storage (artifact repositories, registries, caches), leading to execution of malicious code in production. Relying only on filenames, timestamps, or repository trust without cryptographic validation exposes the supply chain to substitution or replay attacks.

Remediation:

• Enforce mandatory cryptographic signing (e.g., GPG, Cosign, Sigstore) of all build artifacts at creation time.
• Verify signatures and checksums before artifact promotion or deployment; fail builds if validation is missing or invalid.
• Restrict artifact repository access to signed uploads only, and configure clients to reject unsigned or unverified art