Add detection of axios-style supply chain poisoning attacks

[virtualian]

Summary

The recent axios supply chain poisoning attack demonstrated a critical gap in npm ecosystem security: compromised maintainer credentials were used to publish malicious versions of a trusted, widely-used package. The malicious versions included postinstall scripts that exfiltrated sensitive environment variables (NPM_TOKEN, AWS keys, etc.) to attacker-controlled infrastructure.

npm-scanner currently detects several supply chain attack vectors (typosquatting, remote dynamic dependencies, known attacker patterns, lifecycle script abuse), but lacks detection for poisoning of legitimate, established packages — the most dangerous class of supply chain attack.

Problem

When a legitimate package like axios is compromised via stolen maintainer credentials, the current scanner misses it because:

• The package comes from the official npm registry (not a remote dynamic dependency)
• The maintainer account is legitimate with a real email (not disposable/suspicious)
• The package is established with high download counts and long history (not flagged by age/popularity heuristics)
• The malicious infrastructure may not yet be in our IOC list

This is acknowledged in our threat model (docs/users/explanation/threat-model.md) under "False Negatives": "Malicious code in established packages".

Proposed Detection Capabilities

1. Environment Variable Exfiltration Detection

Scan install scripts and bundled JS files for patterns that access sensitive environment variables:

• process.env.NPM_TOKEN, process.env.AWS_SECRET_ACCESS_KEY, etc.
• Bulk process.env access combined with network calls (http.request, fetch, XMLHttpRequest, axios, node-fetch)
• Base64 encoding of environment data (Buffer.from(JSON.stringify(process.env)))

2. Suspicious Install Script Behavior in Established Packages

Flag when an established package (high downloads, old creation date) suddenly:

• Adds or modifies preinstall/install/postinstall scripts in a new version
• Introduces network calls in install scripts that weren't present before
• Adds obfuscated or encoded strings in install scripts

3. Version Anomaly Detection

Detect suspicious publishing patterns:

• Rapid successive patch releases (potential incident response / attack iteration)
• Version published by a different maintainer than usual
• Large changes in package size between versions (new bundled files)
• New dependencies added to a previously dependency-free package

4. Known Axios Poisoning IOCs

Add specific indicators of compromise from the axios incident to npm-audit-lib.sh:

• Known malicious domains/IPs used for exfiltration
• Known malicious script patterns and payloads
• Affected version ranges

Implementation Notes

• Detection should integrate with the existing risk scoring system in package-validator.sh
• New patterns should be added to the shared library npm-audit-lib.sh
• Must maintain zero-dependency policy (bash + system tools only)
• Environment variable exfiltration detection is highest priority — it catches the broadest class of these attacks

Affected Files

• scripts/npm-audit-lib.sh — New IOCs and shared detection functions
• scripts/package-validator.sh — New risk checks and scoring
• scripts/audit-installed-packages.sh — Integration of new checks
• scripts/npm-security-audit.sh — Integration of new checks
• docs/ — Corresponding documentation updates

References

• axios supply chain attack analysis
• Current threat model: docs/users/explanation/threat-model.md