Postmortem: Supply Chain Attack via Compromised NPM Package 11 Caused a Production Data Leak

// scan-node-modules.js
// Scans all installed NPM packages for suspicious postinstall scripts
// that may exfiltrate environment variables or make unauthorized network requests
const fs = require('fs');
const path = require('path');
const { promisify } = require('util');
const readdir = promisify(fs.readdir);
const readFile = promisify(fs.readFile);
const stat = promisify(fs.stat);

// List of known malicious C2 domains from our internal threat intel feed
const BLOCKED_DOMAINS = new Set([
  'c2-leak-metrics.xyz',
  'npm-telemetry-fake.io',
  'pkg-analytics-collector.com'
]);

// Regular expressions to detect suspicious behavior in postinstall scripts
const SUSPICIOUS_PATTERNS = [
  /process\.env\.DB_CONNECTION_STRING/i,
  /process\.env\.AWS_SECRET/i,
  /https?:\/\/[^\s'"]+/i, // Unauthorized network requests
  /child_process\.exec\(/i, // Shell command execution
  /fs\.writeFile.*\/tmp\//i // Writing sensitive data to temp
];

/**
 * Recursively scans a directory for package.json files
 * @param {string} dir - Directory to scan
 * @returns {Promise} Array of package.json paths
 */
async function findPackageJsonFiles(dir) {
  let results = [];
  try {
    const entries = await readdir(dir);
    for (const entry of entries) {
      const fullPath = path.join(dir, entry);
      try {
        const entryStat = await stat(fullPath);
        if (entryStat.isDirectory()) {
          // Skip node_modules/.cache and other non-package dirs
          if (entry === '.cache' || entry === 'dist' || entry === 'build') continue;
          results = results.concat(await findPackageJsonFiles(fullPath));
        } else if (entry === 'package.json') {
          results.push(fullPath);
        }
      } catch (err) {
        console.error(`Error accessing ${fullPath}: ${err.message}`);
        continue;
      }
    }
  } catch (err) {
    console.error(`Error reading directory ${dir}: ${err.message}`);
  }
  return results;
}

/**
 * Checks a single package.json for suspicious postinstall scripts
 * @param {string} packageJsonPath - Path to package.json
 * @returns {Promise} Array of suspicious findings
 */
async function checkPackage(packageJsonPath) {
  const findings = [];
  try {
    const packageContent = await readFile(packageJsonPath, 'utf8');
    const packageJson = JSON.parse(packageContent);
    const pkgName = packageJson.name || 'unknown';
    const pkgVersion = packageJson.version || 'unknown';
    const scripts = packageJson.scripts || {};

    // Check postinstall script if it exists
    if (scripts.postinstall) {
      const postinstall = scripts.postinstall;
      // Check for suspicious patterns
      for (const pattern of SUSPICIOUS_PATTERNS) {
        if (pattern.test(postinstall)) {
          findings.push({
            package: `${pkgName}@${pkgVersion}`,
            file: packageJsonPath,
            script: 'postinstall',
            pattern: pattern.source,
            content: postinstall
          });
        }
      }
      // Check for blocked domains in postinstall
      const urlMatches = postinstall.match(/https?:\/\/([^\s'"]+)/gi) || [];
      for (const url of urlMatches) {
        const domain = url.replace(/https?:\/\/([^\/]+).*/, '$1');
        if (BLOCKED_DOMAINS.has(domain)) {
          findings.push({
            package: `${pkgName}@${pkgVersion}`,
            file: packageJsonPath,
            script: 'postinstall',
            pattern: 'BLOCKED_DOMAIN',
            content: `Blocked domain found: ${domain}`
          });
        }
      }
    }
  } catch (err) {
    console.error(`Error parsing ${packageJsonPath}: ${err.message}`);
  }
  return findings;
}

// Main execution
(async () => {
  const nodeModulesPath = path.join(__dirname, 'node_modules');
  console.log(`Scanning ${nodeModulesPath} for malicious postinstall scripts...`);
  const packageJsonPaths = await findPackageJsonFiles(nodeModulesPath);
  console.log(`Found ${packageJsonPaths.length} package.json files to check.`);
  let allFindings = [];
  for (const pkgPath of packageJsonPaths) {
    const findings = await checkPackage(pkgPath);
    allFindings = allFindings.concat(findings);
  }
  if (allFindings.length === 0) {
    console.log('No suspicious postinstall scripts found.');
  } else {
    console.log(`Found ${allFindings.length} suspicious package(s):`);
    allFindings.forEach(finding => {
      console.log(`\nPackage: ${finding.package}`);
      console.log(`File: ${finding.file}`);
      console.log(`Matched Pattern: ${finding.pattern}`);
      console.log(`Content: ${finding.content.substring(0, 200)}...`);
    });
  }
})();

// lock-dependencies.js
// Enforces strict version pinning for NPM dependencies to prevent
// accidental installation of compromised major versions (e.g., 11.x)
// Includes integration with CI/CD pipelines and audit logging
const fs = require('fs');
const path = require('path');
const { execSync } = require('child_process');
const { promisify } = require('util');
const writeFile = promisify(fs.writeFile);
const readFile = promisify(fs.readFile);
const access = promisify(fs.access);

// Configuration: packages to enforce strict pinning for (no ^ or ~)
const STRICT_PIN_PACKAGES = new Set([
  'json-serializer-utils',
  'express',
  'pg', // PostgreSQL client, high risk if compromised
  'redis',
  'aws-sdk'
]);

// Allowed version ranges: only allow patch updates for non-strict packages
const ALLOWED_RANGE = '~'; // Only patch updates, no minor/major

/**
 * Validates that a package.json does not use ^ or > in version ranges
 * for strict pin packages, and uses ~ for others
 * @param {object} packageJson - Parsed package.json object
 * @returns {string[]} Array of validation errors
 */
function validateVersionRanges(packageJson) {
  const errors = [];
  const dependencyTypes = ['dependencies', 'devDependencies', 'peerDependencies'];
  for (const depType of dependencyTypes) {
    const deps = packageJson[depType] || {};
    for (const [pkg, version] of Object.entries(deps)) {
      // Check strict pin packages first
      if (STRICT_PIN_PACKAGES.has(pkg)) {
        if (version.startsWith('^') || version.startsWith('~') || version.startsWith('>')) {
          errors.push(`Strict pin package ${pkg} uses invalid range ${version}. Must use exact version (e.g., 11.2.3)`);
        }
      } else {
        // For non-strict packages, only allow ~ (patch updates)
        if (version.startsWith('^') || version.startsWith('>')) {
          errors.push(`Package ${pkg} uses invalid range ${version}. Use ~ for patch-only updates.`);
        }
      }
    }
  }
  return errors;
}

/**
 * Updates package.json to enforce version pinning rules
 * @param {string} packageJsonPath - Path to package.json
 * @returns {Promise} True if updates were made
 */
async function enforcePinning(packageJsonPath) {
  try {
    const content = await readFile(packageJsonPath, 'utf8');
    const packageJson = JSON.parse(content);
    let updated = false;

    const dependencyTypes = ['dependencies', 'devDependencies', 'peerDependencies'];
    for (const depType of dependencyTypes) {
      const deps = packageJson[depType] || {};
      for (const [pkg, version] of Object.entries(deps)) {
        if (STRICT_PIN_PACKAGES.has(pkg)) {
          // Strip any semver ranges, use exact version
          const exactVersion = version.replace(/[^0-9.]/g, '');
          if (version !== exactVersion) {
            packageJson[depType][pkg] = exactVersion;
            updated = true;
            console.log(`Pinned ${pkg} to exact version ${exactVersion}`);
          }
        } else {
          // Replace ^ with ~ for patch-only updates
          if (version.startsWith('^')) {
            const patchedVersion = version.replace('^', '~');
            packageJson[depType][pkg] = patchedVersion;
            updated = true;
            console.log(`Changed ${pkg} from ^ to ~: ${patchedVersion}`);
          }
        }
      }
    }

    if (updated) {
      await writeFile(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
      console.log(`Updated ${packageJsonPath} to enforce version pinning.`);
    }
    return updated;
  } catch (err) {
    console.error(`Error processing ${packageJsonPath}: ${err.message}`);
    return false;
  }
}

/**
 * Runs npm install with frozen lockfile to prevent version drift
 * @returns {boolean} True if install succeeded
 */
function frozenInstall() {
  try {
    console.log('Running npm ci --frozen-lockfile to enforce lockfile versions...');
    execSync('npm ci --frozen-lockfile', { stdio: 'inherit' });
    console.log('Frozen install completed successfully.');
    return true;
  } catch (err) {
    console.error(`Frozen install failed: ${err.message}`);
    return false;
  }
}

// Main execution
(async () => {
  const packageJsonPath = path.join(__dirname, 'package.json');
  // Check if package.json exists
  try {
    await access(packageJsonPath, fs.constants.F_OK);
  } catch (err) {
    console.error('package.json not found. Exiting.');
    process.exit(1);
  }

  // Validate version ranges
  const packageContent = await readFile(packageJsonPath, 'utf8');
  const packageJson = JSON.parse(packageContent);
  const errors = validateVersionRanges(packageJson);
  if (errors.length > 0) {
    console.error('Version range validation failed:');
    errors.forEach(err => console.error(`- ${err}`));
    process.exit(1);
  }

  // Enforce pinning
  const updated = await enforcePinning(packageJsonPath);
  if (updated) {
    console.log('Regenerating package-lock.json...');
    execSync('npm install', { stdio: 'inherit' });
  }

  // Run frozen install to confirm no drift
  if (!frozenInstall()) {
    process.exit(1);
  }

  console.log('Dependency version pinning enforced successfully.');
})();

// runtime-exfil-monitor.js
// Runtime monitor to detect and block unauthorized access to environment variables
// and network exfiltration attempts from NPM packages
const fs = require('fs');
const path = require('path');
const http = require('http');
const https = require('https');
const { URL } = require('url');
const originalEnvGet = Object.getOwnPropertyDescriptor(process, 'env').get;
const originalHttpRequest = http.request;
const originalHttpsRequest = https.request;

// Blocked C2 domains from threat intel
const BLOCKED_C2_DOMAINS = new Set([
  'c2-leak-metrics.xyz',
  'npm-telemetry-fake.io',
  'pkg-analytics-collector.com'
]);

// Sensitive environment variable patterns to monitor
const SENSITIVE_ENV_PATTERNS = [
  /DB_/i,
  /AWS_/i,
  /SECRET/i,
  /PASSWORD/i,
  /TOKEN/i,
  /API_KEY/i
];

// Audit log path
const AUDIT_LOG_PATH = path.join(__dirname, 'exfil-audit.log');

/**
 * Logs suspicious activity to audit log and console
 * @param {string} message - Activity message
 */
function logSuspiciousActivity(message) {
  const timestamp = new Date().toISOString();
  const logLine = `${timestamp} | SUSPICIOUS_ACTIVITY | ${message}\n`;
  fs.appendFileSync(AUDIT_LOG_PATH, logLine);
  console.error(logLine.trim());
}

/**
 * Hook process.env access to detect unauthorized reads of sensitive vars
 */
function hookProcessEnv() {
  const originalEnv = process.env;
  const proxy = new Proxy(originalEnv, {
    get(target, prop) {
      const propString = String(prop);
      // Check if accessing sensitive env var
      const isSensitive = SENSITIVE_ENV_PATTERNS.some(pattern => pattern.test(propString));
      if (isSensitive) {
        // Get stack trace to find which package is accessing
        const stack = new Error().stack;
        const packageMatch = stack.match(/node_modules\/([^\/]+)/);
        const packageName = packageMatch ? packageMatch[1] : 'unknown';
        logSuspiciousActivity(`Package ${packageName} accessed sensitive env var ${propString}`);
        // Block access in production? Uncomment to enforce
        // if (process.env.NODE_ENV === 'production') return undefined;
      }
      return originalEnv[prop];
    }
  });
  Object.defineProperty(process, 'env', { get: () => proxy });
}

/**
 * Hook HTTP/HTTPS requests to block C2 communication
 */
function hookNetworkRequests() {
  // Override http.request
  http.request = function(...args) {
    const url = args[0] instanceof URL ? args[0] : new URL(args[0], `http://${args[0].host || 'localhost'}`);
    const domain = url.hostname;
    if (BLOCKED_C2_DOMAINS.has(domain)) {
      const stack = new Error().stack;
      const packageMatch = stack.match(/node_modules\/([^\/]+)/);
      const packageName = packageMatch ? packageMatch[1] : 'unknown';
      logSuspiciousActivity(`Package ${packageName} attempted to connect to blocked C2 domain ${domain}`);
      throw new Error(`Blocked request to ${domain}`);
    }
    return originalHttpRequest.apply(this, args);
  };

  // Override https.request
  https.request = function(...args) {
    const url = args[0] instanceof URL ? args[0] : new URL(args[0], `https://${args[0].host || 'localhost'}`);
    const domain = url.hostname;
    if (BLOCKED_C2_DOMAINS.has(domain)) {
      const stack = new Error().stack;
      const packageMatch = stack.match(/node_modules\/([^\/]+)/);
      const packageName = packageMatch ? packageMatch[1] : 'unknown';
      logSuspiciousActivity(`Package ${packageName} attempted to connect to blocked C2 domain ${domain}`);
      throw new Error(`Blocked request to ${domain}`);
    }
    return originalHttpsRequest.apply(this, args);
  };
}

// Initialize hooks
hookProcessEnv();
hookNetworkRequests();

console.log('Runtime exfiltration monitor initialized. Monitoring process.env and network requests...');

// Example usage: if a malicious package tries to access process.env.DB_CONNECTION_STRING
// and send to C2, it will be logged and blocked.

{
  "dependencies": {
    "json-serializer-utils": "11.2.3",
    "express": "4.18.2",
    "pg": "8.11.3"
  },
  "scripts": {
    "preinstall": "node lock-dependencies.js",
    "ci": "npm ci --frozen-lockfile"
  }
}

- rule: Detect NPM C2 Connection
  desc: Detect network connections to known NPM supply chain C2 domains
  condition: outbound and fd.sip.name in (c2_domains)
  output: "C2 connection detected (domain=%fd.sip.name container=%container.name)"
  priority: CRITICAL
  exceptions: []

registry=https://private-registry.example.com/npm/
//private-registry.example.com/npm/:_authToken=${NPM_TOKEN}
always-auth=true
fallback-registry=false