Supply Chain Zero Days: Closing the Gap Between Publication and Detection

The article describes a real-world supply chain attack involving the compromise of npm packages in the keyv/cacheable ecosystem, where a malicious actor exploited a GitHub maintainer account to publish backdoored versions. The malware dynamically retrieved command-and-control (C2) domains at runtime by querying an Ethereum smart contract, evading static analysis. Wiz's detection pipeline identified the malicious behavior through dynamic analysis and runtime monitoring, detecting connections to a suspicious domain before a CVE was published. This allowed proactive alerting and blocking within customer environments via automated threat intelligence distribution.

AI-extracted · verify before operational use