Wiz Describes Pipeline for Detecting Malicious npm Packages at Publication

Summary

Wiz says its pipeline analyzes new npm releases with static and dynamic analysis, sandboxed execution, and runtime monitoring to detect malicious packages before CVEs are published. It describes detecting keyv malware that retrieved C2 domains through an Ethereum smart

Key points

Wiz reports that supply chain attacks accounted for 25% of significant incidents in H1 2026, up from about 10% in H2 2025.
The pipeline compares new npm package versions with previous releases, uses static analysis and an AI classifier, then dynamically analyzes suspicious versions in a sandbox.
Dynamic testing includes installing and running packages and monitoring runtime behavior with the Wiz Sensor.
For the keyv attack, compromised packages retrieved C2 domains at runtime through an Ethereum smart contract, making the domains unavailable to static source-code analysis.
Wiz says the pipeline detected the malicious network activity and distributed confirmed indicators and detection rules across its platform before a formal CVE was published.
Wiz reports that the Axios compromise involved two malicious npm versions and that execution was observed in 3% of affected environments.

Article Details

Defense Focus: Detect compromised npm packages at publication and during installation or upgrade, before traditional vulnerability databases or CVEs identify the threat.
Detection Methods: Compare newly published package versions with previous versions.
Use static analysis to flag suspicious files, then validate suspicious versions with dynamic analysis in a sandbox.
Install packages, import versions and exposed modules, and run packages from the CLI where possible to observe runtime behavior.
Use Wiz Sensor to monitor runtime activity, including connections to malicious domains retrieved dynamically through an Ethereum smart contract.
Combine static and dynamic analysis, runtime monitoring, and AI classification to assess whether a package version is malicious.
Data Sources: New and previous npm package versions and their extracted contents
Sandbox observations from package installation, module imports, and CLI execution
Runtime activity observed by Wiz Sensor, including network connections
Package and dependency findings from code and cloud scanning pipelines
Rule Types: Automatically updated detection rules for malicious packages in Wiz Defend
Configurable runtime detection and response policies
Platforms: Wiz Defend
Wiz platform
Wiz reputation service
Threat intelligence center
Code and cloud scanning pipelines
Defensive Actions: Analyze newly published package versions promptly and prevent installation of versions confirmed as malicious.
Evaluate dependencies during each install or upgrade, and alert when compromised packages are found.
Distribute confirmed package intelligence and detection rules across security tools and pipelines.
Use runtime analysis to detect malicious network connections when C2 domains are retrieved dynamically and are absent from package source code.