<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-compromised-dependencies
description: >-
  Detect compromised dependencies through behavioral analysis, install script
  inspection, network call monitoring, and anomalous update pattern detection.
  Identify supply chain attacks like event-stream, ua-parser-js, and node-ipc.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - compromised-packages
  - malware-detection
  - behavioral-analysis
  - install-scripts
  - supply-chain-attack
  - dependency-audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Compromised Dependencies

## Overview

Compromised dependencies are legitimate packages that have been taken over by
attackers or intentionally sabotaged by maintainers. Unlike typosquatting, these
attacks abuse existing trust relationships. This skill covers detecting malicious
install scripts, anomalous code changes, suspicious network behavior, and
unexpected maintainer transfers through static analysis and runtime monitoring.

Mode: `[MODE: BLUE]` — Detect compromised packages; `[MODE: RED]` — Simulate package compromise.

## Prerequisites

| Requirement | Details |
|---|---|
| npm/pip/go CLIs for package inspection | Required |
| Socket.dev CLI or Snyk for package analysis | Required |
| strace/dtrace for runtime monitoring (Linux/macOS) | Required |
| jq for JSON processing | Required |
| Python 3.10+ | Required |

## Key Concepts

### Install Script Inspection

```bash
# npm — check for install scripts
npm view <package> scripts --json | jq '{preinstall, postinstall, install, prepare}'

# List all packages with install scripts in project
jq -r '.dependencies + .devDependencies | keys[]' package.json | while read pkg; do
  scripts=$(npm view "$pkg" scripts --json 2>/dev/null | jq -r 'to_entries[] | select(.key | test("install|prepare")) | .key')
  if [ -n "$scripts" ]; then
    echo "WARNING: $pkg has scripts: $scripts"
  fi
done

# Inspect install script content
npm pack <package> && tar xzf <package>-*.tgz
cat package/scripts/postinstall.sh
```

### Network Behavior Monitoring

```bash
# Monitor network calls during npm install (Linux)
strace -f -e trace=network npm install <package> 2>&1 | grep -E "connect|sendto"

# Monitor DNS queries during install
sudo tcpdump -i any -n port 53 &
npm install <package>
kill %1

# macOS — use dtrace
sudo dtrace -n 'syscall::connect:entry /execname == "node"/ { trace(arg0); }' &
npm install <package>
```

### Anomalous Update Detection

```bash
# Check maintainer changes
npm view <package> maintainers --json

# Compare maintainers between versions
diff <(npm view <package>@1.0.0 maintainers --json) \
     <(npm view <package>@1.0.1 maintainers --json)

# Check for large code changes in minor/patch updates
npm pack <package>@1.0.0 && npm pack <package>@1.0.1
diff -r <(tar xzf <package>-1.0.0.tgz -C /tmp/v1) <(tar xzf <package>-1.0.1.tgz -C /tmp/v2)
```

## Workflow

### Step 1: Scan Dependencies for Suspicious Indicators

```bash
node scripts/agent.js --action scan --manifest package.json --output /tmp/scan-report.json
```

### Step 2: Analyze Specific Package

```bash
node scripts/agent.js --action analyze --package event-stream --version 3.3.6 --output /tmp/analysis.json
```

### Step 3: Monitor Install Behavior

```bash
node scripts/agent.js --action monitor --package suspicious-pkg --output /tmp/monitor.json
```

## Detection

```yaml
title: Compromised Dependencies Detection
id: 9babcd9c-8ed9-44ec-9ba7-bcf85b3ecf39
status: experimental
description: Detects suspicious activity related to detecting compromised dependencies techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*detecting*compromised*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Compromised Dependencies Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All install scripts reviewed for unexpected behavior
- [ ] Network monitoring active during dependency installation
- [ ] Maintainer changes tracked for critical dependencies
- [ ] Unusual code changes in patch/minor versions flagged
- [ ] Lock files reviewed for unexpected dependency additions
- [ ] Socket.dev or similar tool integrated in CI pipeline

## References

- [Socket.dev — Package Analysis](https://socket.dev/)
- [npm Advisory Database](https://github.com/advisories)
- [OpenSSF Package Analysis](https://github.com/ossf/package-analysis)
- [MITRE ATT&CK T1195.001 — Compromise Software Dependencies](https://attack.mitre.org/techniques/T1195/001/)
