NPM supply chain attack detection?

[AntonioSousa]

Just wondering how, if, it is possible to detect situations like the one that involved NPM some days ago, with Dynatrace?
https://krebsonsecurity.com/2025/09/18-popular-code-packages-hacked-rigged-to-steal-crypto/

[Kenny_Gillette]

I was wondering the same thing

[christian_kreuz]

If you are monitoring logs of your CI/CD pipeline, NPM Cache / Proxy, or even Renovate, you might be able to find the log output containing one of these malicious packages:

fetch logs
| search "*is-arrayish*"

My advise is to check which systems are monitored, and then narrow down the filters to a specialized query for those systems.

You can then re-use that when the next supply chain attack hits the world.

[AntonioSousa]

@christian_kreuz ,

Besides being affected or for forensics purposes, I was more wondering about detecting them before being impacted?

[christian_kreuz]

I am not aware that Dynatrace has a built-in solution that can catch a supply chain attack - at least not in an early stage in the CI/CD pipeline.

One thing that might work into that direction is Runtime Vulnerability Analytics: https://docs.dynatrace.com/docs/secure/application-security/vulnerability-analytics

Though in that case, you already have that vulnerable dependency deployed somewhere, therefore someone might already have successfully exploited the supply chain attack.

[Kenny_Gillette]

So if I see this then there is still an issue?

[christian_kreuz]

You need to check the logs in detail. If you still see a certain dependency in a certain version being used in logs, then it's worthwhile investigating (could be a Pull Request Build, could be a release build, ...).

[tfellinger]

Hello Antonio,

I'm currently working on a sample workflow that fetches malicious packages from OSV and compares them to monitored entities. It's currently a prototype, but the final version will create detection findings so they appear in the Threats & Exploits app.

Is that going into the direction you're thinking of?

If you'd like to provide feedback I'm happy to share the current version with you.

[AntonioSousa]

There's another nasty one that has been revealed to happen with 40+ NPM packages:

https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised