<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-supply-chain-malware
description: >-
  Detect and analyze supply chain compromise including trojanized packages,
  malicious dependencies, compromised build pipelines, and software update
  hijacking attacks.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - supply-chain
  - dependency-analysis
  - trojanized-packages
  - typosquatting
  - build-pipeline
  - software-integrity
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Analyzing Supply Chain Malware

## Overview

Supply chain attacks compromise software at the source — trojanizing packages in npm/PyPI/RubyGems, injecting backdoors into build pipelines, hijacking software updates, or compromising code signing infrastructure. These attacks achieve wide distribution through trusted channels, making detection exceptionally difficult. Analysis requires package integrity verification, dependency auditing, build artifact comparison, and behavioral analysis of suspicious update mechanisms.

## Prerequisites

- Package manager audit tools (`npm audit`, `pip-audit`, `bundler-audit`)
- Sigstore / cosign for supply chain attestation verification
- SLSA framework understanding
- Diff tools for source-to-binary comparison
- Sandbox for dynamic analysis of suspicious packages
- YARA rules for known supply chain malware families

## Key Concepts

### Supply Chain Attack Vectors

| Vector | Technique | Example |
|--------|-----------|---------|
| Typosquatting | Register similar package names | `crossenv` (npm) |
| Dependency confusion | Private name collision | Alex Birsan research (2021) |
| Account takeover | Compromise maintainer account | `ua-parser-js` (npm) |
| Build system | Inject into CI/CD pipeline | SolarWinds/SUNBURST |
| Update hijack | Compromise update server | NotPetya/M.E.Doc |
| Code signing | Steal or forge signing keys | ASUS Live Update |

### Package Ecosystem Risks

| Ecosystem | Registry | Install Hooks | Risk Level |
|-----------|----------|---------------|------------|
| npm | npmjs.com | `preinstall`, `postinstall`, `install` | High |
| PyPI | pypi.org | `setup.py` execution | High |
| RubyGems | rubygems.org | `extconf.rb` | Medium |
| Maven | central.sonatype.com | Build plugins | Medium |
| Go | proxy.golang.org | None (compile only) | Lower |

## Workflow

### Step 1: Audit Dependencies

```bash
# npm — audit for known vulnerabilities
npm audit --json > npm_audit.json
npm audit fix --dry-run

# Python — pip-audit
pip-audit --format json --output pip_audit.json
pip-audit --require-hashes -r requirements.txt

# Ruby
bundle audit check --update

# Check for typosquatting indicators
python3 -c "
import json
from pathlib import Path

# Load package.json dependencies
pkg = json.loads(Path('package.json').read_text())
deps = list(pkg.get('dependencies', {}).keys())
deps += list(pkg.get('devDependencies', {}).keys())

# Check for suspicious patterns
for dep in sorted(deps):
    # Short names (1-2 chars) — potential placeholder
    if len(dep) <= 2:
        print(f'⚠ Very short name: {dep}')
    # Names similar to popular packages
    if any(c in dep for c in ['0', '1', 'l', 'I'] if dep != dep.replace(c, '')):
        print(f'⚠ Potential typosquat: {dep}')
"
```

### Step 2: Analyze Package Install Scripts

```bash
# npm — inspect install scripts before installing
npm pack <package>@<version>
tar xzf <package>-<version>.tgz
cat package/package.json | jq '.scripts'

# Check for suspicious install hooks
grep -rn "preinstall\|postinstall\|install" package/package.json

# Python — inspect setup.py for code execution
# DANGER: Do NOT run setup.py directly
cat setup.py | grep -iE "os\.system|subprocess|exec|eval|import requests"

# Analyze Python package without installing
pip download <package>==<version> --no-deps
unzip <package>-<version>.whl -d extracted/
cat extracted/*/METADATA
```

### Step 3: Verify Package Integrity

```bash
# npm — verify package checksum
npm view <package>@<version> dist.integrity

# Compare against lockfile
npm ci --ignore-scripts  # Install from lockfile without hooks

# Python — verify with hashes
pip install --require-hashes -r requirements.txt

# Sigstore cosign verification
cosign verify-blob --signature sig.sig --certificate cert.pem artifact

# SLSA provenance verification
slsa-verifier verify-artifact artifact.tar.gz \
    --provenance-path provenance.intoto.jsonl \
    --source-uri github.com/org/repo
```

### Step 4: Diff Source Against Published Package

```bash
# Clone source repository
git clone https://github.com/org/package.git
git checkout v1.2.3

# Download published package
npm pack package@1.2.3
tar xzf package-1.2.3.tgz

# Diff source vs published
diff -rq package/ source_repo/src/ | head -50

# For compiled packages — reproducible build verification
# Build locally and compare hashes
npm run build
sha256sum dist/* > local_hashes.txt
sha256sum package/dist/* > published_hashes.txt
diff local_hashes.txt published_hashes.txt
```

### Step 5: Dynamic Analysis of Suspicious Package

```bash
# Run in isolated container
docker run --rm --network=none -v ./package:/pkg node:alpine sh -c \
    "cd /pkg && npm install --ignore-scripts && npm test"

# Monitor with strace (Linux)
strace -f -e trace=network,write,execve npm install suspicious-package 2> strace.log

# Analyze strace output for suspicious activity
grep -E "connect|execve|open.*WRONLY" strace.log | \
    grep -v "/node_modules"

# DNS/network monitoring during install
tcpdump -i any -w install_traffic.pcap &
npm install suspicious-package --ignore-scripts=false
kill %1
tshark -r install_traffic.pcap -Y "dns.qr==0" -T fields -e dns.qry.name
```

## YARA Rule

```yara
rule Supply_Chain_NPM_Malicious_Install {
    meta:
        description = "Detects malicious npm package install scripts"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1195.002"
        severity = "critical"
    strings:
        $preinstall = "\"preinstall\"" ascii
        $postinstall = "\"postinstall\"" ascii
        $curl = /curl\s+https?:\/\// ascii
        $wget = /wget\s+https?:\/\// ascii
        $exec = /child_process|exec\(|execSync/ ascii
        $b64 = /Buffer\.from\(['""][A-Za-z0-9+\/=]{40,}['"]/ ascii
        $env_exfil = /process\.env/ ascii
        $dns_exfil = /dns\.resolve|dgram/ ascii
    condition:
        ($preinstall or $postinstall) and
        (any of ($curl, $wget, $exec, $b64)) and
        any of ($env_exfil, $dns_exfil)
}
```

## Detection

```yaml
title: Supply Chain Malware Detection
id: 95f35d49-cd10-47d3-a251-e4900e2a6307
status: experimental
description: Detects suspicious activity related to analyzing supply chain malware techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*supply*"
  condition: selection
level: high
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] All dependencies audited for known vulnerabilities
- [ ] Package install scripts reviewed for malicious code
- [ ] Package integrity verified (checksums, signatures)
- [ ] Source-to-published diff completed for critical packages
- [ ] Suspicious packages analyzed in isolated sandbox
- [ ] Network activity during installation monitored
- [ ] Findings mapped to MITRE ATT&CK (T1195.001, T1195.002)

## References

- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [SLSA — Supply-chain Levels for Software Artifacts](https://slsa.dev/)
- [Sigstore — Software Supply Chain Security](https://www.sigstore.dev/)
- [OpenSSF Scorecard — Security Health Metrics](https://securityscorecards.dev/)
