Wiz details npm publication-time detection pipeline, citing Axios and keyv supply chain compromises
Wiz describes a supply chain detection pipeline that analyzes new npm package versions at publication, so malicious releases can be flagged before a CVE or advisory exists. Wiz Research says notable supply chain attacks rose from about 10% of significant incidents in H2 2025 to 25% in H1 2026. The article cites two compromises: the Axios npm maintainer account takeover and the keyv/cacheable ecosystem attack. This is largely vendor product content, but it carries some useful incident details.
Technical Details
- Axios compromise: an unknown actor took over an axios maintainer's npm account and published two malicious versions, v1.14.1 and v0.30.4. These added a dependency on a newly created malicious package, plain-crypto-js. The versions were removed within hours. Wiz reports Axios was present in about 80% of cloud and code environments and downloaded roughly 100 million times a week, with execution observed in 3% of affected environments.
- keyv attack: multiple npm packages in the keyv/cacheable ecosystem were compromised after a GitHub maintainer account was taken over. The malware retrieved its C2 domains at runtime by querying an Ethereum smart contract instead of hardcoding them, which defeats static extraction of C2 infrastructure.
- Pipeline: it downloads the new and previous versions and diffs them, then runs static analysis feeding an AI classifier for an initial verdict. Suspicious versions go to sandbox dynamic analysis (install, import, CLI run) with Wiz Sensor runtime monitoring. The classifier issues a final verdict, and confirmed IOCs are pushed automatically to the Wiz reputation service, Wiz Defend, and code and cloud scanning. In the keyv case, network activity to the malicious domain was detected automatically without human intervention.
Remediation
- Evaluate dependencies at each install or upgrade rather than relying on CVE feeds alone.
- Be cautious with pipelines configured to automatically pull the latest versions of trusted packages.
- Check environments for the affected Axios versions (v1.14.1, v0.30.4), the plain-crypto-js dependency, and compromised keyv versions.
Linha do tempo
-
Wiz details npm publication-time detection pipeline, citing Axios and keyv supply chain compromises
ler a análise desta fonte ocultar
Wiz describes a supply chain detection pipeline that analyzes new npm package versions at publication, so malicious releases can be flagged before a CVE or advisory exists. Wiz Research says notable supply chain attacks rose from about 10% of significant incidents in H2 2025 to 25% in H1 2026. The article cites two compromises: the Axios npm maintainer account takeover and the keyv/cacheable ecosystem attack. This is largely vendor product content, but it carries some useful incident details.
Technical Details
- Axios compromise: an unknown actor took over an axios maintainer's npm account and published two malicious versions, v1.14.1 and v0.30.4. These added a dependency on a newly created malicious package, plain-crypto-js. The versions were removed within hours. Wiz reports Axios was present in about 80% of cloud and code environments and downloaded roughly 100 million times a week, with execution observed in 3% of affected environments.
- keyv attack: multiple npm packages in the keyv/cacheable ecosystem were compromised after a GitHub maintainer account was taken over. The malware retrieved its C2 domains at runtime by querying an Ethereum smart contract instead of hardcoding them, which defeats static extraction of C2 infrastructure.
- Pipeline: it downloads the new and previous versions and diffs them, then runs static analysis feeding an AI classifier for an initial verdict. Suspicious versions go to sandbox dynamic analysis (install, import, CLI run) with Wiz Sensor runtime monitoring. The classifier issues a final verdict, and confirmed IOCs are pushed automatically to the Wiz reputation service, Wiz Defend, and code and cloud scanning. In the keyv case, network activity to the malicious domain was detected automatically without human intervention.
Remediation
- Evaluate dependencies at each install or upgrade rather than relying on CVE feeds alone.
- Be cautious with pipelines configured to automatically pull the latest versions of trusted packages.
- Check environments for the affected Axios versions (v1.14.1, v0.30.4), the plain-crypto-js dependency, and compromised keyv versions.