Six Ways to Catch npm Supply Chain Attacks

The npm ecosystem experienced several major security incidents in 2026. In March, the axios package was compromised, which placed a remote access trojan (RAT) into two releases used by millions of projects. The Megalodon campaign followed in May, rewriting CI/CD workflow files in thousands of GitHub repositories to steal pipeline secrets. By August, a self-propagating worm used stolen maintainer credentials to compromise more npm packages automatically.

These attacks used different entry points and payloads. No single security control covers every scenario. Package scanning identifies known-bad releases, and endpoint detection identifies execution on a host. CI/CD controls prevent unauthorized workflow changes. Network telemetry provides visibility when a compromised system communicates with external servers. These six detection and prevention measures address the major npm supply chain attacks of 2026.

The 2026 npm Supply Chain Attack Wave

These six measures are designed to counter the following campaigns.

• axios (March 31, 2026). Attackers employed social engineering to obtain the login credentials of the lead axios maintainer. They published two versions of the library that included a backdoor. The library receives over 100 million downloads each week. The malicious dependency installed a remote access trojan (RAT) capable of operating on multiple platforms. Amazon Threat Intelligence reported that a group associated with the DPRK carried out the attack. The group is identified as Sapphire Sleet or BlueNoroff. Researchers connected this event to earlier npm compromises by the same group. Those earlier compromises included the September 2025 attacks on the debug and chalk libraries. Wiz reported that those earlier attacks impacted 10% of the cloud environments they monitored. These facts suggest that the axios compromise is part of an ongoing campaign rather than an isolated incident.

• Megalodon (May 18, 2026). This campaign involved 5,718 malicious commits to 5,561 GitHub repositories with weak branch protection during a six-hour period. The attackers injected CI/CD workflow files to steal cloud credentials, SSH keys, and GitHub Actions OIDC tokens from pipeline runs.

• ChainDrop / Shai-Hulud resurgence (August 4, 2026). Microsoft identified this self-propagating worm as a Mini Shai-Hulud variant. It compromised over 400 npm packages, including those in the keyv and cacheable ecosystems. A single stolen maintainer token allowed it to publish malicious releases for every package controlled by that account. It harvested npm tokens, GitHub credentials, and cloud keys. The worm fetched its active C2 address from an Ethereum contract at runtime or used a signed GitHub commit as a fallback.

The entry points for these attacks vary. However, the trend shows a move toward automation where attackers no longer need to manually ship malicious releases. The attacks also move from the registry toward the CI/CD systems that use the packages.

Inside the axios Compromise

The axios incident illustrates how these attacks function. On March 31, two poisoned versions, axios@1.14.1 and axios@0.30.4, were available on npm for approximately three hours. The axios source code remained unchanged. The malware was included through a new dependency called plain-crypto-js@4.2.1. A clean version, 4.2.0, was published 18 hours earlier to establish a history. Version 4.2.1 included the payload in a postinstall hook:

{
  "scripts": {
    "postinstall": "node setup.js"
  }
}

The hook executed setup.js during the npm install process. Any system that installed these versions and ran lifecycle scripts was exposed. The dropper contacted the attacker's C2 server at sfrclak.com:8000 every 60 seconds. The malware obfuscated its payload and deleted itself after replacing its package.json with a clean version. C2 requests used specific strings in the POST body to select payloads for macOS, Windows, or Linux while appearing as npm traffic. Google's GTIG identifies this stage-2 implant as WAVESHAPER.V2.

Match Known C2 Infrastructure

Matching outbound traffic against known malicious destinations is an effective security layer. Once infrastructure is identified, matching traffic is a simple lookup process. AlphaSOC collects indicators from over 70 sources and maintains a list of more than one million active malicious destinations. When sfrclak.com was identified as axios C2 infrastructure, any DNS query or connection to it triggered an OCSF detection finding. AlphaSOC added the sfrclak.com and 142.11.206.73 indicators and notified customers with observed callbacks. This method also covers ChainDrop C2 domains like npm-cache.com and the Megalodon exfiltration address 216.126.225.129:8443. These detections correspond to MITRE ATT&CK T1195.002 and T1071.001.

Security teams can use Sigma rules to match this infrastructure in DNS logs by using specific indicators:

title: npm Supply Chain C2 Lookup (axios, sfrclak.com)
id: c0fc26ff-51ce-4522-b287-a9ac8df334de
status: stable
description: |
  Detects DNS queries for sfrclak.com associated with the supply chain
  attack on the axios npm package (March 31 2026). Malicious versions
  axios@1.14.1 and axios@0.30.4 delivered the WAVESHAPER.V2 RAT via a
  postinstall hook in plain-crypto-js@4.2.1.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
  - https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/
author: AlphaSOC
date: 2026-04-01
tags:
  - attack.command_and_control
logsource:
  category: dns
detection:
  selection:
    dns.query.name|contains:
      - 'sfrclak.com'
  condition: selection
falsepositives:
  - Unlikely; validate historical or research-related lookups
level: critical

Look for Rare Destinations

Matching known-bad infrastructure only works after the infrastructure is identified. ChainDrop resolved its C2 address from a blockchain contract, meaning there was no fixed domain to block in advance. Destination prevalence provides an earlier signal. AlphaSOC scores destinations based on frequency across its customer base. A newly registered destination with little history receives a higher anomaly score. The domain sfrclak.com was registered one day before the axios attack. If multiple organizations contact a previously unseen destination simultaneously, the score increases. This method helps identify unknown infrastructure before it appears in threat intelligence feeds.

Keep Enough Data to Hunt Backwards

Attribution often occurs weeks after traffic is observed. High-volume network telemetry is expensive to store, so teams often keep only a short searchable window or a subset of data. AlphaSOC stores normalized OCSF telemetry in a customer-specific data lake to preserve raw evidence for retrospective hunting. Telemetry collected before an indicator was known remains queryable even if those events did not trigger a finding at ingestion. When sfrclak.com was identified, the March callbacks were still available. In Splunk, set the scope to the exposure window (00:21 to 03:20 UTC, March 31) and match the retained event layer:

| alphasoc class_name=dns_activity query.hostname=sfrclak.com

Use the ChainDrop C2 domains to hunt another hostname, or match an IP indicator such as the Megalodon exfiltration address with dst_endpoint.ip=216.126.225.129. Scope each hunt to its specific window.

Detect Install-Time Execution

Network layers identify the callback, while the endpoint identifies the moment the installer runs. Install-time scripts are a common delivery path. A process-creation rule that flags a bundled installer script spawned by node during a lifecycle hook is a practical starting point (MITRE T1059.007). Coverage requires the agent to be present and configured when a self-deleting dropper runs. This method supplements network layers. The template below requires tuning for your environment because filenames like setup.js appear in legitimate packages. See enhanced threat detection with Sigma and AlphaSOC for information on authoring these rules.

title: npm Lifecycle Script Spawning a Bundled Installer (template)
id: ed540cf4-6c27-402d-9b7b-18c35805de69
status: experimental
description: |
  Hunting template for a node.js lifecycle hook spawning a bundled installer
  script, the delivery pattern used by plain-crypto-js@4.2.1 in the axios
  supply chain attack. setup.js is generic; tune the filename, path, and
  parent-process context to your environment before operational use.
author: AlphaSOC
date: 2026-04-01
tags:
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'setup.js'
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
  condition: selection
falsepositives:
  - Legitimate packages with a setup.js lifecycle script; review context
level: medium

Protect CI/CD Workflows

Megalodon primarily attacked GitHub Actions rather than the npm registry. It pushed backdoored workflow files into repositories with weak branch protection and used a workflow_dispatch trigger to pull secrets from pipeline runs. Require review for changes to workflow files and monitor for new workflows from unfamiliar committers. Treat OIDC or secret access from a pipeline that does not require it as suspicious. Routing CI/CD egress through network detection is also useful. A runner connecting to a Megalodon address is a finding regardless of where it runs.

Reduce Risk at Install Time

These steps do not remove the root cause, but reducing what runs at install time decreases the attack surface. A standard npm audit will not flag a malicious preinstall or postinstall script on a new dependency. Pin direct dependencies, enforce the lockfile, and use package-manager overrides to constrain transitive dependencies. npm v12, released July 8, 2026, blocks dependency lifecycle scripts and implicit node-gyp builds unless they are explicitly allowed. This removes the automatic path used in the axios exploit, and npm now scans new packages for malware. These changes reduce risk but do not eliminate the threat of compromised maintainer accounts for packages like debug, chalk, and axios.

Final Thoughts

Network telemetry provides a consistent detection surface across the axios, Megalodon, and ChainDrop attacks, despite their different execution paths. ChainDrop authors hid the C2 address by resolving it from a blockchain contract at runtime instead of including it in the package. While the address was hidden, the connection was visible. Outbound traffic is a detection surface that remains even when host-level evasion occurs. A dropper can delete itself and a CI runner can be removed, but the beacon must still leave the system.

This does not apply to every threat. Malware that only destroys data, alters a build, or exfiltrates through a legitimate service like the GitHub API may not produce a unique callback. Network layers are a part of defense in depth rather than a complete replacement for other methods. When a callback exists, it is difficult for an attacker to remove.

AlphaSOC generates OCSF detection findings from cloud, application, network, and endpoint telemetry without manual rule authoring. Start a free evaluation and connect your DNS telemetry.

Learn More

From AlphaSOC

• Threat detection tools
• Finding patient zero with security analytics
• Sigma correlations in AlphaSOC

Research and sources

• Microsoft: ChainDrop supply chain compromise
• Microsoft: mitigating the axios npm supply chain compromise
• Google GTIG: North Korea threat actor targets the axios npm package
• Amazon: North Korean group behind open-source supply chain attacks
• Wiz: npm supply chain attack impact across debug and chalk
• StepSecurity: Megalodon GitHub Actions secret exfiltration
• GitHub: npm install-time security changes (npm v12)

---