<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Compromised Dependencies — API Reference

## npm Package Inspection

```bash
# View package scripts
npm view <package> scripts --json

# View maintainers
npm view <package> maintainers --json

# View publication times
npm view <package> time --json

# Download package tarball
npm pack <package>@<version>

# Extract and inspect
tar xzf <package>-<version>.tgz
```

## Socket.dev CLI

```bash
# Analyze package
socket npm info <package>

# Scan project
socket scan create --repo . --branch main

# Check for known issues
socket report create --repo .
```

## OpenSSF Package Analysis

```bash
# Run package-analysis locally
docker run --rm \
  -e PACKAGE_NAME=<package> \
  -e ECOSYSTEM=npm \
  ghcr.io/ossf/package-analysis/analysis

# Check Package Feeds for new packages
# https://github.com/ossf/package-feeds
```

## Runtime Monitoring

```bash
# Linux — trace network syscalls during install
strace -f -e trace=connect,sendto,recvfrom npm install <package> 2>&1

# Linux — trace file operations
strace -f -e trace=open,openat,write npm install <package> 2>&1

# macOS — network monitoring
sudo dtrace -n 'syscall::connect:entry /execname == "node"/ { trace(arg0); }'

# DNS monitoring
sudo tcpdump -i any -n port 53

# Process monitoring
sudo auditctl -w /tmp -p wa -k npm_install
```

## Suspicious Code Patterns

| Pattern | Risk | Description |
|---------|------|-------------|
| `eval(Buffer.from(...))` | Critical | Obfuscated code execution |
| `child_process.exec()` | High | System command execution |
| `require('http').request()` | High | Outbound network call |
| `process.env` access | Medium | Environment variable exfiltration |
| `fs.readFileSync('/etc/passwd')` | Critical | Sensitive file access |
| Install hooks + network | Critical | Classic supply chain attack pattern |

## Notable Compromised Packages

| Package | Year | Attack Type |
|---------|------|-------------|
| event-stream | 2018 | Maintainer social engineering → crypto theft |
| ua-parser-js | 2021 | Account compromise → cryptominer |
| node-ipc | 2022 | Maintainer protest → file destruction |
| colors/faker | 2022 | Maintainer protest → infinite loop |
| Codecov uploader | 2021 | Build script compromise → credential theft |
