Rules / GL064
GL064 Typosquatting in CI Catalog component include
Severity: warn
OWASP: CICD-SEC-3 – Dependency Chain Abuse
CWE: CWE-829 – Inclusion of Functionality from Untrusted Control Sphere
Risk
When a pipeline uses include: component:, a one-character typo in the component path (e.g. componets/opentofu instead of components/opentofu) can resolve to a different namespace that an attacker controls. The attacker registers the typo'd namespace, publishes a malicious component, and any pipeline with the typo silently executes their code.
Trigger example
include:
- component: componets/opentofu/opentofu@1.0.0 # one edit from components/opentofu
How detection works
glsec ships a baked-in corpus of popular component resource paths (namespace/project) from the GitLab CI Catalog. For each include: component: entry it extracts the resource path (stripping the host, @version, and component-name segments) and compares it against the corpus by edit distance. A finding is raised when the distance is exactly 1 and the top-level namespace differs from the corpus entry.
Same-namespace near-misses (e.g. components/opentofu-beta) are not flagged — that namespace is already controlled by the same owner, so it is not a squat.
Safe alternative
Copy the exact component path from the CI Catalog listing rather than typing it by hand, and pin it to a tag or SHA (GL041).
include:
- component: components/opentofu/opentofu@1.0.0 # exact match — not flagged
Notes
- Severity is
warn: without a live API check glsec cannot confirm the typo'd path actually exists, so this is a heuristic. Treat it as a prompt to double-check the path. - The corpus is fully offline (no API calls at scan time) and is regenerated from the GitLab GraphQL
ciCatalogResourcesAPI (sorted by star count) at release time; it needs periodic refreshes as the catalog grows. - Suppress per-file with
.glsec-ignoreor inline# glsec:ignore GL064once you have verified the path is correct.
Documentation for glsec 1.23.0. Source of this page · Rule implementation