Full Report
When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published
Analysis Summary
# Tool/Technique: Supply Chain Compromise of Trusted Packages (Axios npm Incident) and Wiz's Publication-Time Detection Pipeline
## Overview
This Wiz article is not a profile of a single malware family. It covers a **supply chain attack technique**, where an attacker compromises a trusted open source package so that malicious code reaches developer environments and build pipelines before a CVE exists. It uses the November 2025 Axios npm compromise as its main example and describes Wiz's detection pipeline, which analyzes new npm package versions at publication to catch these zero-day compromises.
## Technical Details
- **Type:** Technique (supply chain compromise), with a defensive tooling component (Wiz supply chain detection pipeline)
- **Platform:** npm (Node.js) ecosystem; affects developer workstations, CI/CD pipelines, and cloud workloads that pull packages automatically
- **Capabilities (of the attack):** Maintainer account takeover, publication of malicious package versions, injection of a malicious dependency (`plain-crypto-js`), rapid spread through automatic dependency updates
- **Capabilities (of the detection pipeline):** Automated download and diffing of package versions, static analysis, AI-based classification, sandboxed dynamic analysis, runtime monitoring via the Wiz Sensor, automated IOC publication
- **First Seen:** The article is dated October 19, 2026. The Axios compromise is referenced without a specific date in the excerpt.
## MITRE ATT&CK Mapping
*Mappings below are inferred from the article's description and are not stated in the source.*
- **TA0001 - Initial Access**
- T1195 - Supply Chain Compromise
- T1195.001 - Compromise Software Dependencies and Development Tools
- **TA0004 - Privilege Escalation / TA0001 - Initial Access**
- T1078 - Valid Accounts (npm maintainer account compromise)
- **TA0002 - Execution**
- T1204 - User Execution (developers or pipelines pulling and running the malicious version)
## Functionality
### Core Capabilities (Attack Pattern)
- Compromise of a maintainer's npm account
- Publication of two malicious Axios versions (v1.14.1, v0.30.4)
- Introduction of a dependency on a newly created malicious package, `plain-crypto-js`
- Automatic propagation through unpinned dependency updates
- Observed execution in about 3% of affected environments, with Axios present in roughly 80% of cloud and code environments and downloaded around 100 million times per week
### Advanced Features (Wiz Detection Pipeline)
- Triggered on each new npm version, comparing it against previous versions
- Static analysis feeding an AI classifier for an initial verdict
- Dynamic analysis: sandboxed installation, module import, CLI execution, and runtime monitoring via the Wiz Sensor
- Final AI verdict based on combined evidence
- Automatic publication of IOCs to the Wiz reputation service
- Downstream alerts through Threat Intelligence Center, code and cloud scanning, and Wiz Defend detection rules
## Indicators of Compromise
- **File Hashes:** Not provided in the article excerpt
- **File Names:** Not provided
- **Registry Keys:** Not applicable
- **Network Indicators:** No C2 infrastructure is described in the excerpt. The vendor reference is `axios-http[.]com` (legitimate project site, listed only as a reference)
- **Package Indicators:**
- `axios` v1.14.1 and v0.30.4 (malicious versions, since removed from npm)
- `plain-crypto-js` (malicious dependency)
- **Behavioral Indicators:** Installation of the malicious Axios version pulling in `plain-crypto-js`; runtime activity observed in sandbox and by the Wiz Sensor (specifics not given in the excerpt)
## Associated Threat Actors
- **Unknown threat actor** for the Axios compromise (not attributed in the article)
## Detection Methods
- **Signature/IOC-based:** Matching against published malicious package versions and names (`axios` 1.14.1 / 0.30.4, `plain-crypto-js`) through the Wiz reputation service and threat intelligence notifications
- **Behavioral:** Sandbox execution of new package versions, runtime monitoring for malicious activity via the Wiz Sensor, and AI-based classification of static and dynamic evidence
- **Diff-based analysis:** Comparing new versions with previous versions to flag newly introduced files or dependencies
- **YARA rules:** Not mentioned in the article
## Mitigation Strategies
- **Pin dependency versions** and use lockfiles so automatic updates do not pull new versions without review
- **Introduce a delay or cooldown** before adopting newly published package versions, giving time for community and vendor detection
- **Monitor for newly introduced dependencies** in updated packages, especially new packages with no history
- **Scan packages at install time** and in CI/CD, not only against CVE databases, since zero-day compromises may not yet have CVEs
- **Enforce strong account security** for package maintainers (MFA, scoped publish tokens, trusted publishing)
- **Restrict install-time script execution** where feasible and isolate build environments
- **Maintain an inventory** of where high-impact packages such as Axios are used across code and cloud environments
- **Use a supply chain threat intelligence feed** to receive alerts on compromised package versions quickly
## Related Tools/Techniques
- **Shai-Hulud npm worm (2025):** Self-propagating npm supply chain worm that spread through compromised maintainer credentials
- **Compromises of popular npm packages such as chalk and debug (September 2025):** Maintainer account phishing leading to malicious updates
- **event-stream incident (2018):** Malicious dependency added through maintainer handover, a classic supply chain compromise
- **Wiz Defend and Wiz Sensor:** Wiz's runtime detection and supply chain pipeline described in the article