domains / families / security / detecting-malicious-npm-packages

detecting-malicious-npm-packages

separate

Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.

When to use

• Triaging a specific npm package before adding it as a dependency.
• Vetting a full `package.json` / `package-lock.json` during code review or onboarding a third-party library.
• Responding to a supply-chain advisory (e.g., a worm campaign) and needing to check whether your lockfiles pulled a known-bad version.
• Investigating an endpoint or CI runner suspected of having installed a trojanized package.
• Building a pre-install gate in CI/CD that blocks packages exhibiting malicious indicators.

Skill page

Source