<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-supply-chain-attacks-in-browsers
description: >-
  Detect supply chain attacks targeting browser environments including compromised npm packages, malicious browser extensions, CDN hijacking, and dependency confusion in frontend applications.
domain: cybersecurity
subdomain: browser-security
tags:
  - supply-chain
  - npm
  - cdn-hijacking
  - dependency-confusion
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
  frameworks: ["MITRE ATT&CK", "OWASP"]
  tools: ["socket-security", "snyk", "semgrep"]
---

# Detecting Supply Chain Attacks In Browsers

## Overview

Detect supply chain attacks targeting browser environments including compromised npm packages, malicious browser extensions, CDN hijacking, and dependency confusion in frontend applications.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `socket-security` | Security tooling |
| `snyk` | Security tooling |
| `semgrep` | Security tooling |
| Package audit tools, SRI verification, CDN monitoring capability | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
npm audit --json && node scripts/agent.js audit --lockfile package-lock.json
```

## Workflow

### Step 1: Audit Dependencies

```bash
npm audit --json && node scripts/agent.js audit --lockfile package-lock.json
```

### Step 2: Verify CDN Integrity

```bash
node scripts/agent.js verify --url https://target.com --check sri
```

### Step 3: Monitor for Typosquatting

```bash
node scripts/agent.js scan --lockfile package-lock.json --check typosquat
```

## Detection

```yaml
title: Supply Chain Attacks In Browsers Detection
id: 2e21d736-cee2-4862-b9dd-2e63f87f931d
status: experimental
description: Detects suspicious activity related to detecting supply chain attacks in browsers techniques in browser security context
logsource:
  category: proxy
  product: windows
detection:
  selection:
    cs_uri_query: "*script*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Browser security extensions performing routine URL reputation checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Supply Chain Attacks In Browsers Detection | windows/proxy | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- **Verify dependency audit**: `node scripts/agent.js audit --lockfile package-lock.json`
- **Confirm SRI coverage**: `node scripts/agent.js verify --url https://target.com --check sri`

## References

- MITRE ATT&CK: T1195.002
- Frameworks: MITRE ATT&CK, OWASP
- Tools: socket-security, snyk, semgrep
