Download Pumping: npm Supply Chain Deception — Detection and Hardening Guide

---
title: Potential Malicious npm Postinstall Script Execution
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects npm or node spawning a shell (cmd, bash, powershell), which is a common behavior for malicious packages executing postinstall scripts.
references:
 - https://www.tenable.com/blog/how-cyberattackers-inflate-malicious-package-npm-download-counts
author: Security Arsenal
date: 2025/02/10
tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1059.003
 - attack.t1059.004
logsource:
 category: process_creation
 product: windows
detection:
 selection_parent:
   ParentImage|endswith:
     - '\node.exe'
     - '\npm.cmd'
     - '\npm-cli.js'
 selection_child:
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
 condition: all of them
falsepositives:
 - Legitimate build scripts that require shell access (verify specific package usage)
level: high
---
title: npm Spawning Network Tools on Linux
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects npm processes spawning curl or wget, often used by malicious packages to fetch second-stage payloads or beacon out.
references:
 - https://www.tenable.com/blog/how-cyberattackers-inflate-malicious-package-npm-download-counts
author: Security Arsenal
date: 2025/02/10
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: process_creation
 product: linux
detection:
 selection_parent:
   ParentImage|endswith:
     - '/node'
     - '/npm'
   ParentCommandLine|contains: 'install'
 selection_child:
   Image|endswith:
     - '/curl'
     - '/wget'
 condition: all of them
falsepositives:
 - Legitimate package installers fetching resources (rare, should be vetted)
level: high

// Hunt for npm processes spawning shells or network tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("node.exe", "npm.cmd", "node", "npm") 
| where InitiatingProcessCommandLine contains "install"
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe", "bash", "sh", "curl", "wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine, FolderPath
| order by Timestamp desc

-- Hunt for suspicious child processes spawned by npm/node installs
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Commandline AS ParentCmd
FROM pslist()
WHERE Parent.Name IN ("node", "npm", "node.exe", "npm.cmd")
  AND Parent.Commandline =~ "install"
  AND Name IN ("bash", "sh", "powershell.exe", "cmd.exe", "curl", "wget", "powershell")

#!/bin/bash
# npm Hardening and Audit Script
# Run this on developer workstations and build agents

echo "[+] Auditing npm configuration and package integrity..."

# 1. Prevent npm from executing scripts during install (mitigates postinstall attacks)
# Note: This may break legitimate packages that rely on install scripts.
echo "[+] Checking if ignore-scripts is enabled..."
if npm config get ignore-scripts | grep -q "true"; then
    echo "[+] ignore-scripts is already enabled."
else
    echo "[WARNING] ignore-scripts is NOT enabled."
    echo "[+] Enabling ignore-scripts globally to mitigate automated payload execution..."
    npm config set ignore-scripts true
fi

# 2. Audit current package. files for unusual scripts
echo "[+] Searching for package. files in current directory..."
find . -name "package." -type f -exec sh -c '
    echo "Analyzing: $1"
    # Check for preinstall/postinstall scripts that call powershell, curl, or wget
    if jq -e ".scripts | to_entries[] | select(.key | test("pre|post")) | select(.value | test("powershell|curl|wget|bash|cmd"))" "$1" > /dev/null 2>&1; then
        echo "[ALERT] Suspicious install script detected in $1"
    else
        echo "[OK] No highly suspicious install scripts found in $1"
    fi
' _ {} \;

echo "[+] Audit complete."