AID-H-022: Dependency Change Vetting & Sandboxed Installation

Version 1.20261015 · Family — navigation only

This family secures two connected but distinct stages: risk review of a proposed dependency change before merge, and isolated deterministic installation of already-approved immutable package bytes. The children provide the implementation controls for those stages.

Scope boundary

Owns pre-merge dependency-change risk review and isolated deterministic installation of already-approved immutable package bytes. It does not make the authoritative final admission decision for the exact dependency population consumed by build or deployment.

AID-H-003.001: AID-H-022 reviews proposed changes and contains installation; AID-H-003.001 admits the complete exact package population resolved for the build or deployment. Review and sandbox evidence support but cannot replace final byte-level admission.

AID-H-023: AID-H-022 owns change risk and hostile installation behavior; AID-H-023 owns publisher identity, registry workflow, trusted CI release origin, and package provenance. A trusted publisher can ship a risky change, and a safe-looking change can come from a compromised publisher path.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0010 AI Supply Chain Compromise
AML.T0010.001 AI Supply Chain Compromise: AI Software
AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
AML.T0011 User Execution
AML.T0011.001 User Execution: Malicious Package
AML.T0025 Exfiltration via Cyber Means
AML.T0060 Publish Hallucinated Entities
AML.T0072 Cyber Communication Channel
AML.T0074 Masquerading
AML.T0109 AI Supply Chain Rug Pull
AML.T0111 AI Supply Chain Reputation Inflation
AML.T0115 Publish Poisoned AI Artifacts
AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
AML.T0119 Exploit Automated Artifact Processing Pipeline

MAESTRO

Compromised Framework Components (L3)
Supply Chain Attacks (Cross-Layer)
Lateral Movement (Cross-Layer)

OWASP LLM Top 10 2026

LLM04:2026 Supply Chain

OWASP ML Top 10 2023

ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities
ASI05:2026 Unexpected Code Execution (RCE)

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

AITech-9.3 Dependency / Plugin Compromise
AISubtech-9.3.1 Malicious Package / Tool Injection
AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
AISubtech-9.3.3 Dependency Replacement / Rug Pull

Google Secure AI Framework 2.0 - Risks

MST: Model Source Tampering
IIC: Insecure Integrated Component

Databricks AI Security Framework 3.0

Algorithms 5.4: Malicious libraries
Model 7.3: ML Supply chain vulnerabilities
Agents - Core 13.11: Unexpected RCE and Code Attacks
Agents - Tools MCP Server 13.18: Tool Poisoning
Agents - Tools MCP Server 13.21: Supply Chain Attacks