Listen to this Post
Introduction:
Every time news breaks about another compromised npm package, developers immediately panic, wondering if their projects or machines are affected. The typical response involves manually grepping lockfiles across dozens of repositories, a slow and error-prone process that often misses malicious injections lurking in transitive dependencies. To solve this, ProjectDiscovery has released depx, a fast passive CLI tool that answers critical supply-chain security questions in seconds.
Learning Objectives:
- Understand how to audit an entire local system for malicious npm packages using a single `depx` command.
- Learn to scan all repositories within a GitHub organization to detect compromised dependencies across the software supply chain.
- Master the use of security-focused CLI commands for lockfile analysis, local file system scanning, and CI pipeline integration.
You Should Know:
- Passive Intelligence: How `depx` Detects Malicious Packages Without Touching Your Code
`depx` is a read-only intelligence CLI that never executes package install scripts or modifies your source code. It works by creating a compiled local index of known malicious packages sourced from the OpenSSF Malicious Packages repository, which tracks hijacked publishes, credential stealers, and install-script backdoors. The tool supplements this foundational data with a live intelligence feed curated from social media platforms, refreshed hourly. This approach ensures you’re alerted to zero-day malicious packages within minutes of public disclosure, not hours or days later.
Step‑by‑step guide to install and perform a basic package safety check:
- Install `depx` using the official install script (requires Linux/macOS):
curl -sfL https://raw.githubusercontent.com/projectdiscovery/depx/main/scripts/install.sh | sh
The script automatically fetches the latest release for your operating system and architecture, verifies the binary, and updates your shell
PATH.
2. Verify the installation:
depx --help
Expected output shows available commands: feed, audit, github, search, id, and global flags like `–json` and --verbose.
- Check if a specific package is safe to install before adding it to your project:
depx search npm:express
(Replace `npm:express` with `pypi:requests` or `go:github.com/gorilla/mux` depending on ecosystem.)
-
View the live feed of recently disclosed malicious packages:
depx feed
This displays time-ordered cards showing package name, ecosystem, impacted namespaces, and disclosure age.
5. For machine-readable output (CI/CD or scripting):
depx search npm:axios --json | jq .
The `–json` flag produces a versioned JSON envelope suitable for automation.
- Deep System Audit: Scanning Your Entire Home Directory for Infected Lockfiles
Traditional tools like `npm audit` only scan the current project’s `package-lock.json` and rely on a vulnerability database that often misses malicious packages not yet assigned CVE identifiers. In contrast, `depx` recursively walks your file system, identifies all package-lock.json, yarn.lock, pnpm-lock.yaml, and SBOM files, then cross-references each resolved package version against its locally cached malicious index.
Step‑by‑step guide to audit your entire machine:
- Run the default audit on your $HOME directory:
depx audit
By default, `depx audit` scans from your home directory outward, examining every lockfile it discovers.
2. Audit a specific project directory:
depx audit /path/to/your/project
- Exclude known-good internal packages to reduce false positives:
Create a file `exclude.txt` containing:
@mycompany/[email protected] [email protected]
Then run:
depx audit --exclude-pkg exclude.txt
This is essential for organizations that maintain private packages or wish to whitelist thoroughly vetted dependencies.
4. Require a clean audit for CI gates:
depx audit --require-clean
If any malicious package is found, `depx` exits with a non‑zero code, failing the CI pipeline and preventing unsafe builds from proceeding.
- Export results in SARIF format for security dashboards:
depx audit --sarif > audit.sarif
SARIF is the standard interchange format for static analysis results, compatible with GitHub Advanced Security and many SIEM platforms.
-
GitHub Organization Auditing: Mapping Supply‑Chain Risk Across Your Entire Development Ecosystem
Manual auditing across dozens or hundreds of repositories is impractical. `depx` integrates with the GitHub Dependency Graph API to export SBOMs (Software Bill of Materials) for each repository in an organization, then performs a bulk malicious package check without ever cloning code. This allows security teams to answer, “Do any of my org’s repos ship a malicious package?” in seconds rather than days.
Step‑by‑step guide to scanning a GitHub organization:
- Set a GitHub personal access token with `repo` and `read:org` scopes:
export GITHUB_TOKEN=ghp_YourTokenHere
2. Audit a specific organization:
depx github --org your-org-1ame
- Audit all repositories belonging to a user or team within an organization:
depx github --org your-org-1ame --team security-team
-
Combine GitHub auditing with local `–require-clean` for comprehensive CI:
depx github --org your-org-1ame --require-clean
-
Output results in JSON for integration with internal dashboards:
depx github --org your-org-1ame --json | jq '.results[].malicious_packages'
-
Vulnerability Exploitation Context: Recent High‑Profile npm Supply‑Chain Attacks
The urgency for tools like `depx` is underscored by a wave of sophisticated attacks. The node-ipc compromise (May 2026) used an expired maintainer email domain to hijack a package with 822,000 weekly downloads, delivering a credential stealer via DNS TXT tunneling that bypassed HTTP-layer firewalls. The Mini Shai-Hulud worm hit in three waves: the TanStack CI/CD hijack (84 malicious artifacts in 6 minutes), the AntV/atool maintainer compromise (600+ malicious versions across 300+ packages), and the Nx Console VS Code extension poisoning—all using daemonized persistence and geographic killswitches. Meanwhile, the TrapDoor campaign spanned npm, PyPI, and Crates.io with 384+ malicious versions using Fernet + ECDH encrypted payloads and AI context poisoning via zero‑width Unicode injection in configuration files. These incidents demonstrate that attackers no longer rely solely on typosquatting; they actively compromise maintainer accounts, poison CI/CD pipelines, and inject obfuscated preinstall hooks. depx’s passive, signature‑based detection is designed specifically to catch these emerging threat patterns without executing any potentially harmful code.
- Integrating `depx` with Existing Security Pipelines and Complementary Tools
For organizations already using other supply‑chain security tools, `depx` serves as a specialized malicious‑package detector that complements broader vulnerability scanners. Unlike Snyk or npm audit, which focus on known CVEs, `depx` targets the distinct class of malicious packages that may have no assigned CVE but contain credential stealers or backdoors. It can be combined with lockfile-lint, which enforces host whitelists and HTTPS validation, to cover both malicious content and configuration drift. For offline or air‑gapped environments, pre‑built binaries are available on the GitHub releases page, and the local malicious index can be manually synced. The tool’s exit codes—0 for clean or warnings, 1 for critical findings with --strict—enable straightforward integration into any CI system.
Step‑by‑step guide to blocking unsafe package installations using depx:
- Create a wrapper script to replace
npm install:!/bin/bash safe-install.sh if ! depx search npm:$1 --json | jq -e '.malicious == false' ; then echo "Blocked: Package $1 is known malicious" exit 1 fi npm install $1
2. Use `depx` in a pre‑commit hook:
Add to `.git/hooks/pre-commit`:
!/bin/sh depx audit --require-clean || exit 1
- Schedule daily org‑wide scans via cron or GitHub Actions:
name: Daily Supply-Chain Scan on: schedule:</li> </ol> - cron: '0 2 ' jobs: scan: runs-on: ubuntu-latest steps: - name: Install depx run: curl -sfL https://raw.githubusercontent.com/projectdiscovery/depx/main/scripts/install.sh | sh - name: Audit org env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: depx github --org your-org-1ame --require-clean- Linux and Windows Commands for Manual Lockfile Forensics
While `depx` automates detection, manual inspection remains valuable for deep forensics or environments where automated tools cannot run. The following commands help analysts quickly locate and audit lockfiles across operating systems.
Linux / macOS commands:
Find all lockfiles recursively from current directory find . -1ame "package-lock.json" -o -1ame "yarn.lock" -o -1ame "pnpm-lock.yaml" Search for a specific malicious package name inside lockfiles grep -r "harmful-package-1ame" --include="package-lock.json" . Display all resolved URLs in a lockfile (useful for detecting rogue registries) jq '.packages[].resolved' < package-lock.json Check lockfile for packages installed from raw.githubusercontent.com grep -E "raw.githubusercontent.com" package-lock.json
Windows PowerShell commands:
Find all lockfiles recursively Get-ChildItem -Recurse -Include "package-lock.json","yarn.lock","pnpm-lock.yaml" Search for suspicious patterns inside lockfiles Select-String -Path .\package-lock.json -Pattern "ngrok|localhost|file://" Extract all package names and versions for manual review Get-Content package-lock.json | Select-String '"version":' -Context 0,1
These commands are effective for triage but lack the intelligence feed and organizational‑scale capabilities of
depx. For production environments, always rely on the automated tool.What Undercode Say:
- Passive detection is a game changer. By never executing package code, `depx` eliminates the risk of accidentally triggering malicious payloads during the audit process—a critical advantage over tools that download or install packages prior to scanning.
- The combined intelligence feed is unique. Merging the curated OpenSSF database with real‑time social media monitoring means `depx` catches packages that haven’t yet been formally added to any vulnerability database. This significantly reduces the window between public disclosure and actionable defense.
- False‑positive control is enterprise‑ready. The ability to exclude known‑good packages via a simple text file makes `depx` practical for large organizations with internal registries or thoroughly vetted dependencies, preventing alert fatigue.
Expected Output:
Introduction: Every time news breaks about another compromised npm package, developers immediately panic, wondering if their projects or machines are affected. The typical response involves manually grepping lockfiles across dozens of repositories, a slow and error-prone process that often misses malicious injections lurking in transitive dependencies. To solve this, ProjectDiscovery has released depx, a fast passive CLI tool that answers critical supply-chain security questions in seconds. What Undercode Say: - Passive detection is a game changer. By never executing package code, depx eliminates the risk of accidentally triggering malicious payloads during the audit process—a critical advantage over tools that download or install packages prior to scanning. - The combined intelligence feed is unique. Merging the curated OpenSSF database with real‑time social media monitoring means depx catches packages that haven’t yet been formally added to any vulnerability database. This significantly reduces the window between public disclosure and actionable defense. - False‑positive control is enterprise‑ready. The ability to exclude known‑good packages via a simple text file makes depx practical for large organizations with internal registries or thoroughly vetted dependencies, preventing alert fatigue.
Prediction:
- -1 Supply-chain attacks will not slow down; the 73% increase in open‑source malware detections from 2024 to 2025 indicates attackers are heavily investing in this vector. As AI accelerates code generation, the asymmetry between attack volume and defense resources will widen.
- +1 Tooling like `depx` will evolve into mandatory CI components, not optional extras, as regulators and auditors demand SBOM‑based malicious‑package attestations. The shift from reactive vulnerability scanning to proactive malicious‑package intelligence will become standard within two years.
- -1 However, attackers will adapt by using ephemeral, short‑lived malicious packages that rotate faster than intelligence feeds can refresh, forcing defenders into a continuous cat‑and‑mouse game. Real‑time behavioral analysis will eventually need to complement passive signature matching.
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by ThousandsIT/Security Reporter URL:
Reported By: Ehsandeepsingh New – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
