The build phase is the part of compilation where a project is turned into a working program. In many development tools, this step can also run custom scripts, code generators, post-processing commands, or other tasks defined by the project.
That flexibility makes the build phase a security boundary. If an attacker poisons a repository or project file, malicious commands may execute when a developer opens or builds the code, even before the app is launched. This is a common abuse point in supply-chain attacks against developer workstations and CI systems. Defenders reduce the risk by reviewing build scripts, limiting what build steps can execute, isolating builds in trusted environments, and monitoring for unexpected changes to project configuration files.