| name | npm-postinstall-attack-scanner |
| description | Detect npm supply chain attacks using the postinstall + hidden dependency pattern. Covers axios takeover (2026-03-31) and similar attacks. |
npm postinstall attack scanner
Detects npm supply chain attacks where a maintainer account is compromised, a malicious dependency is added to package.json, and the dependency's postinstall script delivers malware (RAT).
Trigger
Keywords: "npm supply chain", "npm attack", "postinstall attack", "axios takeover", "compromised package", "npm security check", "supply chain attack"
Usage
Run the scanner on any directory containing Node.js projects:
bash scan.sh [target-directory]
The script checks 5 phases:
- Known compromised versions (lockfile + node_modules)
- Known malicious dependency packages
- Suspicious postinstall scripts (pattern matching)
- Dangerous version ranges on targeted packages
- npm cache for compromised packages
Remediation
If issues are found:
- Pin to safe version:
npm install axios@1.15.0
- Rebuild:
rm -rf node_modules package-lock.json && npm install
- Clear cache:
npm cache clean --force
- Rotate all secrets if RAT may have executed
- Check for RAT artifacts (processes, scheduled tasks, startup files)
Known Compromised Packages
| Package | Version | Malicious Dep | Date |
|---|
| axios | 1.14.1 | plain-crypto-js@^4.2.1 | 2026-03-31 |
| axios | 0.30.4 | plain-crypto-js@^4.2.1 | 2026-03-31 |
More Info
See the full README at: https://github.com/aliksir/npm-postinstall-attack-scanner
