{
  "markdown": "# npm postinstall attack scanner\n\n> 日本語版は [README.ja.md](README.ja.md) を参照してください。\n\nDetects npm supply chain attacks that use the **postinstall + hidden dependency** pattern to deliver malware.\n\nBuilt in response to the [axios maintainer account takeover (2026-03-31)](https://x.com/riku720720/status/2038976598914019546).\n\n### The Attack Pattern\n\n1. Attacker takes over an npm maintainer account (email change, credential theft)\n2. Publishes a new version with a **malicious dependency** added to `package.json` (source code is untouched)\n3. The malicious dependency runs a **postinstall script** that:\n   - Contacts a C&C server\n   - Downloads a platform-specific RAT (Remote Access Trojan)\n   - Self-deletes to hide evidence\n4. Anyone running `npm install` or `npm update` with `^` version ranges gets infected\n\n**Why it's hard to detect**: The package source code is completely clean. The malice is hidden in a transitive dependency's install script.\n\n**Variant pattern (2026-04-03 `mgc`)**: Instead of a fake dependency, the package's own postinstall script downloads platform-specific payloads from GitHub Gists and connects to a C2 server.\n\n### Installation\n\n```bash\n# Clone the repo\ngit clone https://github.com/aliksir/npm-postinstall-attack-scanner.git\ncd npm-postinstall-attack-scanner\n\n# Or just download the script\ncurl -sL https://raw.githubusercontent.com/aliksir/npm-postinstall-attack-scanner/master/scan.sh -o scan.sh\n```\n\nRequirements: `bash` and `npm` (you already have these if you work with Node.js)\n\n### Quick Start\n\n```bash\n# Scan current directory\nbash scan.sh .\n\n# Scan a specific project\nbash scan.sh /path/to/your/project\n\n# Scan all projects\nbash scan.sh /path/to/workspace\n```\n\nIf issues are found, remediation steps are displayed automatically.\n\n### What It Checks (5 Phases)\n\n| Phase | What | How |\n|-------|------|-----|\n| 1 | **Known compromised versions** | Checks lockfile + node_modules for exact version matches |\n| 2 | **Malicious dependencies** | Searches for known malware packages (e.g., `plain-crypto-js`) |\n| 3 | **Suspicious postinstall scripts** | Pattern-matches for eval/exec/network calls in install scripts |\n| 4 | **Dangerous version ranges** | Detects `^`/`~` ranges on targeted packages |\n| 5 | **npm cache** | Checks if compromised packages are cached locally |\n| 6 | **C2 domain / payload host** | Detects known C2 domains and GitHub Gist payload hosts in scripts |\n\n### Output\n\nClean project:\n```\n=== npm postinstall attack scanner ===\n[Phase 1] Known compromised version check\n  [OK] Known compromised versions not found\n[Phase 2] Malicious dependency check\n  [OK] Known malicious dependencies not found\n[Phase 3] Suspicious postinstall script detection\n  [OK] No suspicious postinstall scripts detected\n[Phase 4] Dangerous version range check\n  [OK] No dangerous version ranges on known-targeted packages\n[Phase 5] npm cache check\n  [OK] No compromised packages in npm cache\n=== Scan Summary ===\nNo issues found. Project appears clean.\n```\n\nExit codes: `0` = clean, `1` = issues found.\n\n### GitHub Actions\n\nAdd to your repo's `.github/workflows/scan.yml`:\n\n```yaml\nname: npm postinstall attack scan\n\non:\n  push:\n    paths: ['package.json', 'package-lock.json']\n  pull_request:\n    paths: ['package.json', 'package-lock.json']\n  schedule:\n    - cron: '0 9 * * *'\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: Download scanner\n        run: curl -sL https://raw.githubusercontent.com/aliksir/npm-postinstall-attack-scanner/master/scan.sh -o /tmp/scan.sh\n      - name: Run scan\n        run: bash /tmp/scan.sh .\n```\n\n### Known Compromised Packages\n\n| Package | Version | Malicious Dep / Method | Date | C&C |\n|---------|---------|----------------------|------|-----|\n| axios | 1.14.1 | plain-crypto-js@^4.2.1 | 2026-03-31 | sfrclak.com:8000 |\n| axios | 0.30.4 | plain-crypto-js@^4.2.1 | 2026-03-31 | sfrclak.com:8000 |\n| mgc | 1.2.1-1.2.4 | Self postinstall (GitHub Gist payload) | 2026-04-03 | admondtamang.com.np |\n\n### Adding New Entries\n\nWhen a new attack is discovered, edit `scan.sh` and add to the arrays:\n\n```bash\nKNOWN_COMPROMISED=(\n  # ... existing entries ...\n  \"new-package@bad-version|malicious-dep|description\"\n)\n\nKNOWN_MALICIOUS_DEPS=(\n  # ... existing entries ...\n  \"malicious-dep\"\n)\n```\n\n### Remediation\n\nIf compromised packages are found:\n\n1. **Pin to safe version**: `npm install axios@1.15.0`\n2. **Rebuild**: `rm -rf node_modules package-lock.json && npm install`\n3. **Clear cache**: `npm cache clean --force`\n4. **Rotate secrets** (if RAT may have executed): API keys, tokens, SSH keys, DB credentials, wallet keys\n5. **Check for RAT artifacts**: unexpected processes, new scheduled tasks, modified startup files\n\n### Prevention\n\n- Pin dependency versions exactly (`\"1.15.0\"`, not `\"^1.15.0\"`)\n- Enable npm 2FA with hardware key\n- Use `npm ci` in CI/CD (lockfile integrity check)\n- Add `min-release-age=7` to `.npmrc`\n- Use [Trusted Publisher](https://docs.npmjs.com/generating-provenance-statements) (GitHub OIDC)\n\n### Claude Code Integration\n\nThis scanner is also available as a [Claude Code](https://claude.ai/claude-code) skill. Copy the `claude-code/` directory to `~/.claude/skills/npm-postinstall-attack-scanner/` to use it with `/npm-postinstall-attack-scanner`.\n\n\n## Disclaimer\n\n- This tool detects **known patterns only**. It does not guarantee detection of all supply chain attacks.\n- Always use in combination with other security tools (`npm audit`, `osv-scanner`, `trivy`, etc.).\n- The author assumes no liability for any damages resulting from the use of this tool.\n- The known compromised packages database may not be up to date. Always verify with official sources.\n\n## License\n\nMIT\n",
  "bytes": 5727,
  "sha": "2eeb7dfb95fdcb3e261e620832be5982bf7833a5eb8005982316d31cb82aece2",
  "repo_slug": "aliksir/npm-postinstall-attack-scanner",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_aliksir_npm_postinstall_attack_scanner_n_4c3834b1/readme"
}