GitHub - lateos-ai/npm-scan: Modern supply chain security for the npm ecosystem. Static + behavioral analysis that catches what npm audit, Snyk, and Socket miss — obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation.
Pangram verdict · v3.3
We believe that this document is mainly AI-generated, with some AI-assisted and human-written content
AI likelihood · overall
AIArticle text · 1,515 words · 7 segments analyzed
Modern supply chain security for the npm ecosystem. Static + behavioral analysis that catches what npm audit, Snyk, and Socket miss — obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation. 📌 The Problem The 2025–2026 wave of npm supply chain attacks proved that traditional tooling is no longer enough. Attackers have moved past simple typosquatting. They now ship obfuscated preinstall hooks, credential harvesters hidden behind environment detection, dormant backdoors with time-based activation, and worm-style transitive propagation that spreads through peer dependencies. A growing attack vector is HuggingFace org impersonation — packages that masquerade as legitimate HF model repositories (e.g., 0penai/gpt2 instead of openai/gpt2) to trick users into downloading malicious model artifacts during CI/CD pipelines, often bundled with suspicious binaries (.exe, .dll) in model repos that deep-learned tools trust by default. The Megalodon campaign (2026) alone compromised 5,500+ repositories via fake GitHub PRs, malicious workflow injection, and cloud credential exfiltration — all coordinated through a single actor automating the entire kill chain. @lateos/npm-scan now detects artifacts of this campaign out of the box. The Mini Shai-Hulud worm campaign (May 2026) hit the npm ecosystem in three waves — TanStack CI/CD hijack (84 artifacts in 6 minutes), AntV/atool maintainer compromise (600+ malicious versions across 300+ packages), and Nx Console VS Code extension poisoning (CVE-2026-48027) — all using ctf-scramble-v2 obfuscation, daemonized persistence with CI environment checks, geographic killswitches targeting sanctioned regions, and GitHub C2 dead-drop channels for token recovery. @lateos/npm-scan now detects all 10 Mini Shai-Hulud signals across two detector suites.
The TrapDoor campaign (May 2026) spans npm, PyPI, and Crates.io — 34 malicious packages, 384+ versions attributed to a single publisher, targeting crypto, DeFi, Solana, and AI developers with Fernet + ECDH encrypted payloads, AI context poisoning via zero-width Unicode injection in .cursorrules/CLAUDE.md, and credential live-validation against AWS STS and GitHub API before exfiltration. @lateos/npm-scan now detects all 9 TrapDoor signals. The node-ipc compromise (May 14, 2026) weaponized an expired maintainer email domain to hijack one of npm's most depended-upon packages (822K weekly downloads). Three malicious versions (9.1.6, 9.2.3, 12.0.1) delivered an 80KB credential stealer via DNS TXT tunneling — no HTTP, no postinstall hook, invisible to HTTP-layer firewalls. @lateos/npm-scan now detects all 11 node-ipc compromise signals. The Mass Typosquatting campaign (vpmdhaj) (May 2026) weaponized the vpmdhaj npm maintainer account to publish 14 typosquatted packages in a 4-hour window — targeting AWS/CI/CD environments with preinstall stagers (setup.mjs, stager.js), Bun runtime abuse, and cloud credential exfiltration (AWS IMDSv2, ECS task roles, Vault, GitHub tokens). @lateos/npm-scan now detects all 3 typosquatting campaign signals. The Axios Registry Poisoning campaign (May 2026) compromised the npm registry's axios package metadata to publish [email protected] and [email protected] with injected dependencies (plain-crypto-js) containing cross-platform RAT payloads with C2 callbacks, process injection, and system persistence. @lateos/npm-scan now detects all 3 axios poisoning signals. Critical infrastructure vulnerabilities in the Python ecosystem are also in scope.
The BadHost (CVE-2026-48710) vulnerability in Starlette < 1.0.1 enables authentication bypass via unvalidated HTTP Host header injection, affecting FastAPI, vLLM, LiteLLM, MCP servers, and any project using Starlette transitively — now detected across Python manifests, transitive dependency chains, and source code patterns in a single scan. npm audit checks known CVEs. Snyk scans for vulnerabilities. Socket looks at package behavior. None of them were designed for the generation of attacks that emerged in 2025 — attacks that look benign until they reach production. @lateos/npm-scan was built for this moment. 🔬 Why @lateos/npm-scan? Capability npm audit Snyk Socket @lateos/npm-scan Known CVE matching ✅ ✅ ❌ ✅ Static analysis ❌ ✅ ✅ ✅ Obfuscated payload detection ❌ ❌ ❌ ✅ AST-level heuristic analysis ❌ ❌ ❌ ✅ Runtime behavioral sandbox ❌ ❌ ✅ ✅ Conditional trigger detection (ATK-009) ❌ ❌ ❌ ✅ Sandbox evasion detection (ATK-010) ❌ ❌ ❌ ✅ Transitive worm propagation (ATK-011) ❌ ❌ ❌ ✅ Campaign detection (Megalodon CI/CD) ❌ ❌ ❌ ✅ Worm campaign detection (Mini Shai-Hulud Wave 1–3) ❌ ❌ ❌ ✅ HF model repo impersonation + README clone ❌ ❌ ❌ ✅ VS Code extension supply chain scan (--vsix) ❌ ❌ ❌ ✅ Python vulnerability detection (CVE-2026-48710 BadHost) ❌ ❌ ❌ ✅
Cross-ecosystem attack detection (TrapDoor) ❌ ❌ ❌ ✅ Expired-domain hijack detection (node-ipc) ❌ ❌ ❌ ✅ Malware obfuscation detection (ctf-scramble-v2) ❌ ❌ ❌ ✅ Mass typosquatting campaign (vpmdhaj maintainer) ❌ ❌ ❌ ✅ Registry poisoning detection (axios fake versions) ❌ ❌ ❌ ✅ Attack taxonomy (ATK series) ❌ ❌ ❌ ✅ SBOM output (CycloneDX + SPDX) ❌ ✅ ❌ ✅ SARIF v2.1 (GitHub Code Scanning) ❌ ❌ ❌ ✅ NIST 800-161 compliance reporting ❌ ❌ ❌ ✅ EU CRA compliance reporting ❌ ❌ ❌ ✅ SIEM export (CEF / ECS / Sentinel / QRadar) ❌ ❌ ❌ ✅ Runs entirely locally — no telemetry ✅ ❌ ❌ ✅ Policy-as-code (YAML allowlists) ❌ ❌ ❌ ✅ Privacy first. All scanning happens on your machine. No code leaves your environment. No telemetry. No cloud dependency. ✨ Key Features Icon Feature Description 🕵 Heuristic static analysis AST-level inspection catches obfuscation, eval chains, env probing, and suspicious lifecycle scripts that regex-based tools miss 🧠 Behavioral detection Identifies conditional triggers (time-based, CI-aware), sandbox evasion, and dormant activation patterns 🧬 ATK attack taxonomy 11 classified attack types with NIST 800-161 mappings — versioned, documented, and PR-able 🪱 Worm campaign detection Mini Shai-Hulud — 6 sub-checks detecting burst publish, sibling compromise, SLSA attestation mismatch, publisher drift, IOC match, and token exfil across 3 waves (TanStack, AntV/atool, Nx Console) 🧩 VSIX extension scanning npm-scan scan --vsix
nrwl.angular-console — detects VS Code Marketplace supply chain attacks: burst publish, publisher anomaly, activation event risk, orphan commit fetch, known IOC, and exfil patterns (Nx Console 18.95.0 CVE-2026-48027) 🐍 Python vulnerability detection CVE-2026-48710 (BadHost) — Starlette Host header injection across 6 Python manifest formats, 15 transitive downstream packages (fastapi, vllm, litellm, MCP), and static request.url.path code pattern analysis with scope["path"] suppression 🪤 Cross-ecosystem attack detection TrapDoor — 9 sub-checks: campaign marker P-2024-001, trap-core.js payload fingerprint, publisher blocklist asdxzxc, Gist-based credential exfil, AI config zero-width Unicode poisoning, crypto/DeFi lure name heuristic, Fernet+ECDH encryption, XOR key cargo-build-helper-2026, STS/GitHub API credential validation 📡 Expired-domain hijack detection node-ipc compromise — version blocklist (9.1.6/9.2.3/12.0.1), tarball SHA-256 verification, CJS vs ESM size anomaly with IIFE injection, DNS-over-non-standard-port C2, bootstrap resolver sh.azurestaticprovider.net, DNS TXT exfil zone bt.node.js, setImmediate() runtime trigger, ~/nt-*/ staging artifacts, unauthorized publisher atiertant, lockfile blast-radius with safe pin recommendations ☣ Malware obfuscation detection ctf-scramble-v2 detection — scans package dist/lib for known malware obfuscation patterns (ctf-scramble-v2, ctf-scramble-v3), halts analysis immediately with max severity CRITICAL stop
condition 🎭 Mass typosquatting campaign detection vpmdhaj maintainer blocklist with stop condition, levenshtein-based typosquat detection (opensearch-setup, env-config-manager), preinstall stager identification (setup.mjs, stager.js, Bun runner), AWS ECS/Vault/GitHub credential exfiltration patterns ☠ Registry poisoning detection Axios version blocklist (1.14.1/0.30.4) with stop condition, decoy dependency discovery (plain-crypto-js), cross-platform RAT payload detection (DLL injection, launchd/systemd/cron persistence, PowerShell IEX, C2 callbacks) 🔏 Provenance audit trail Aureus-Elicitor v1.7 framework — HMAC-SHA256 signed detection manifests, content-hash verified audit trails, rule provenance URLs, campaign source attribution. Every finding includes cryptographically verifiable provenance metadata 📦 SBOM generation CycloneDX 1.5 and SPDX 2.3 with findings embedded as vulnerabilities 🔍 SARIF output GitHub Advanced Security / CodeQL compatible SARIF v2.1 — shows findings directly in Security tab 🧾 Compliance reporting NIST SP 800-161 traceability matrix + EU Cyber Resilience Act mapping (free tier) 🔌 SIEM export Splunk CEF, Elastic ECS, Microsoft Sentinel, IBM QRadar formats (premium) 📜 Policy-as-code YAML/JSON policy engine with allowlists, severity overrides, suppressions, and fail-on thresholds 🐳 Docker + GitHub Action Multi-arch images, one-command Compose pipeline, PR scan action 🛡 Zero telemetry No data leaves your machine. No cloud. No callbacks. 💾 Local scan history SQLite-backed persistence, zero external dependencies 🪝 Pre-commit hook Block threats before commit — one-liner install, scans package-lock.json changes 🤖 HF impersonation detection Detects typosquatted HuggingFace orgs (Jaro-Winkler), README clones (SimHash), artifact mismatches (.exe in model repos), and new-org
amplifier — with lazy two-stage evaluation, zero network in Stage 1 📎 Yarn + pnpm support scan-lockfile parses yarn.lock and pnpm-lock.yaml alongside package-lock.json ⚡ Quick Start # Install globally npm install -g @lateos/npm-scan # Scan a single package npm-scan scan lodash # Scan your lockfile npm-scan scan-lockfile # View latest scans npm-scan report No install? No problem: npx @lateos/npm-scan scan commander 🐳 Run @lateos/npm-scan anywhere with Docker — zero installation # Pull and run a single scan — no Node.js or npm required docker run --rm lateos/npm-scan:cli scan lodash # Full pipeline with persistent storage and Compose docker compose --profile pipeline up -d No Node.js. No npm install. No global packages. Works on any system with Docker — CI servers, air-gapped environments, Kubernetes clusters. Multi-arch images for linux/amd64 and linux/arm64. 🛡 Government & SOC 2 Ready Feature SOC 2 Controls NIST 800-161 STIG/FedRAMP Alignment Audit logs (--audit-log) CC6.8 AU-2 ✓ FIPS crypto (--fips) CC6.1 SC-13 ✓ STIG report (--stig) CC7.3 RA-5 ✓ Offline cache (--cache-dir) A1.2 SC-8 ✓ Sigstore provenance CC6.2 SI-7 ✓ SBOM (SPDX/CycloneDX) CC7.4 SA-10 ✓ # Air-gapped scan with full compliance npm-scan scan-lockfile --cache-dir /offline/cache --audit-log /var/log/npm-scan.audit --fips npm-scan report --stig ☁ BYOC — Bring Your Own Cloud Deploy npm-scan in your VPC with full data sovereignty.