800 Malicious npm Packages Delivering Cross-Platform RAT and Infostealer: Supply Chain Detection and Remediation Guide

---
title: NPM Install Lifecycle Script Spawning Shell or Downloader
id: 3f9a1c72-8b4d-4e6f-a2c1-7d5e9b0a3f21
status: experimental
description: Detects npm/npx/node spawning shells, script interpreters, or download utilities consistent with malicious package install-time execution (postinstall hooks delivering RAT/infostealer payloads).
references:
  - https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\npx.cmd'
      - '\node.exe'
      - '\yarn.cmd'
      - '\pnpm.cmd'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_ci:
    CommandLine|contains:
      - 'npm run build'
      - 'npm ci'
  condition: selection_parent and selection_child and not filter_ci
falsepositives:
  - Legitimate packages with native builds (node-gyp) may spawn cmd.exe; baseline per build host and alert on new parent/child pairs.
level: high
---
title: Node.js Executing Inline Script with Network or Credential Access
id: 8c2e5b14-6a3f-4d98-b7e2-1f4a9c6d8e30
status: experimental
description: Detects node.exe launched with inline eval flags or from temporary/user-profile directories, a common loader pattern for malicious npm packages executing payload code directly.
references:
  - https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059.007
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_eval:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - ' -e '
      - '--eval'
      - '-p "'
  selection_path:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\npm-cache\'
      - '%TEMP%'
  filter_known:
    CommandLine|contains:
      - 'npm\\node_modules'
      - '\npx '
  condition: (selection_eval or selection_path) and not filter_known
falsepositives:
  - Developer ad-hoc node -e usage; rare in CI and on standard workstations. Baseline developer machines separately.
level: medium
---
title: Credential Store Access by Node or Package Manager Process
id: 5d7b2f41-9c1e-4a86-c3f5-2b8d6e0a4f19
status: experimental
description: Detects node/npm processes accessing browser credential stores, SSH keys, or cloud CLI credential files, consistent with infostealer staging from a malicious npm package.
references:
  - https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
  selection_target:
    TargetFilename|contains:
      - '\Login Data'
      - '\Cookies'
      - '\Local State'
      - '\.ssh\'
      - '\.aws\credentials'
      - '\.azure\'
      - '\gcloud\'
      - '\.npmrc'
      - '.env'
  condition: selection_image and selection_target
falsepositives:
  - npm legitimately reads .npmrc during authentication; alert on .npmrc only when paired with browser or SSH key paths from the same process tree.
level: high

// Hunt: package-manager or node process spawning shells/downloaders or touching credential stores
// Tables: DeviceProcessEvents + DeviceFileEvents (Defender XDR / Sentinel)
let lookback = 14d;
let suspiciousChildren = dynamic(["powershell.exe","pwsh.exe","cmd.exe","curl.exe","wget.exe","certutil.exe","bitsadmin.exe","mshta.exe","wscript.exe","cscript.exe","sh","bash","zsh"]);
let pmParents = dynamic(["node.exe","npm.exe","npm.cmd","npx.cmd","yarn.cmd","pnpm.cmd","node","npm"]);
let credPaths = dynamic(["Login Data","Local State","\\.ssh\\","/.ssh/",".aws/credentials",".azure/","gcloud",".npmrc","/Cookies"]);
let procHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ (pmParents)
    | where FileName in~ (suspiciousChildren)
    | project TimeGenerated, DeviceName, AccountName,
              Parent=InitiatingProcessFileName, Child=FileName,
              ChildCmd=ProcessCommandLine, ParentCmd=InitiatingProcessCommandLine,
              ReportId, DeviceId;
let fileHits =
    DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ (pmParents)
    | where FolderPath has_any (credPaths)
    | project TimeGenerated, DeviceName, AccountName,
              Process=InitiatingProcessFileName, FileAccessed=FolderPath,
              ReportId, DeviceId;
union procHits, fileHits
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count()
    by DeviceName, AccountName
| where EventCount >= 1
| order by LastSeen desc

-- Velociraptor artifact: hunt for suspicious node/npm process trees and second-stage staging
-- Run across Windows, macOS, and Linux endpoints (developer workstations and build runners)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
        -- Node/npm spawning shells or download utilities
        (Name =~ '(?i)(node|npm|npx|yarn|pnpm)'
         AND CommandLine =~ '(?i)(powershell|cmd\.exe|curl|wget|/bin/sh|/bin/bash|certutil|mshta)')
        OR
        -- Node executing inline/eval code or running from temp paths
        (Name =~ '(?i)node' AND CommandLine =~ '(-e |--eval)')
        OR
        (Name =~ '(?i)node' AND Exe =~ '(?i)(/tmp/|/var/tmp/|AppData.Local.Temp)')
      )

#!/usr/bin/env bash
# audit-npm-exposure.sh — retroactive audit for malicious-package exposure on dev/build hosts
# Checks for lifecycle scripts in installed deps, suspicious postinstall execution, and known-bad patterns.
set -euo pipefail

REPORT="npm_supply_chain_audit_$(date +%Y%m%d_%H%M%S).txt"
echo "=== npm Supply Chain Exposure Audit — $(hostname) — $(date) ===" | tee "$REPORT"

# 1) Find all package.json files with install-time lifecycle hooks (execution at npm install)
echo -e "\n[1] Dependencies with preinstall/install/postinstall hooks:" | tee -a "$REPORT"
find "$HOME" /srv /opt /var/lib -maxdepth 6 -name package.json -path "*node_modules*" 2>/dev/null | while read -r f; do
  if grep -Eq '"(preinstall|install|postinstall)"' "$f"; then
    echo "  HOOK: $f" | tee -a "$REPORT"
    grep -E '"(preinstall|install|postinstall)"' "$f" | tee -a "$REPORT"
  fi
done

# 2) Audit npm global + local caches for recently added, low-reputation packages
echo -e "\n[2] Globally installed packages (review for unrecognized names):" | tee -a "$REPORT"
npm ls -g --depth=0 2>/dev/null | tee -a "$REPORT" || true

# 3) Flag node processes with network connections right now (possible live RAT/loader)
echo -e "\n[3] node/npm processes with active network connections:" | tee -a "$REPORT"
ss -tupn 2>/dev/null | grep -Ei 'node|npm' | tee -a "$REPORT" || echo "  none" | tee -a "$REPORT"

# 4) Check shell history for typosquatted-style installs (manual install of unknown packages)
echo -e "\n[4] Recent manual npm installs from shell history:" | tee -a "$REPORT"
grep -Eh 'npm (install|i) ' "$HOME/.bash_history" "$HOME/.zsh_history" 2>/dev/null | tail -50 | tee -a "$REPORT" || true

echo -e "\n=== Audit complete. Review $REPORT. Cross-reference hook packages against npm advisories and your internal allowlist. ===" | tee -a "$REPORT"

# audit-npm-exposure.ps1 — Windows developer/build host audit for malicious npm package exposure
$report = "npm_audit_$env:COMPUTERNAME_$(Get-Date -Format yyyyMMdd_HHmmss).txt"
"=== npm Supply Chain Audit — $env:COMPUTERNAME — $(Get-Date) ===" | Out-File $report

# 1) Installed dependencies with install-time lifecycle hooks (the primary execution vector)
"`n[1] node_modules packages with preinstall/install/postinstall hooks:" | Out-File $report -Append
Get-ChildItem -Path "$env:USERPROFILE","C:\builds","C:\agents" -Recurse -Filter package.json -Depth 6 -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -match 'node_modules' } |
  ForEach-Object {
    $c = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
    if ($c -match '"(preinstall|install|postinstall)"\s*:') {
      "  HOOK: $($_.FullName)" | Out-File $report -Append
      ($c | Select-String -Pattern '"(preinstall|install|postinstall)"\s*:\s*"[^"]*"' -AllMatches).Matches.Value |
        ForEach-Object { "    $_" | Out-File $report -Append }
    }
  }

# 2) Suspicious child processes historically spawned by node/npm (Defender/advanced hunt alternative)
"`n[2] node/npm processes spawning shells or downloaders (last 7 days, from event log):" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match '(node|npm|npx)\.(exe|cmd)' -and $_.Message -match '(powershell|cmd\.exe|curl|certutil|mshta|wscript)' } |
  Select-Object -First 50 TimeCreated, Message | Out-File $report -Append

# 3) Persistence artifacts commonly abused by cross-platform RATs
"`n[3] Run-key and Startup-folder entries referencing node/npm or temp paths:" | Out-File $report -Append
$runKeys = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $runKeys) {
  Get-ItemProperty $k -ErrorAction SilentlyContinue | Out-String |
    Select-String -Pattern 'node|npm|Temp|AppData' -AllMatches |
    ForEach-Object { $_.Line } | Out-File $report -Append
}

"`n=== Done. Review $report; escalate any unknown hook packages to IR before deleting (preserve evidence). ===" | Out-File $report -Append