Connect

JavaScript Supply Chain Incident Response

rz-xbyrz-x
0•
Security & Testing

Investigates JavaScript and npm supply-chain compromises through campaign attribution, IOC correlation, blast-radius estimation, and incident dossier generation.

Designed for security analysts and incident responders handling compromised npm packages and JavaScript ecosystem threats, this skill automates the critical investigation workflows following initial triage. It correlates extracted indicators of compromise (IOCs) against a structured threat campaign atlas—identifying patterns from actors like Lazarus Contagious Interview, Shai-Hulud, and CDN drainers—while tracking maintainer history for account takeovers. By quantifying downstream blast radius across direct and transitive dependencies and auto-defanging malicious artifacts, it enables rapid generation of standardized triage cards and comprehensive incident dossiers.

Key Features

010 GitHub stars
02Package genealogy analysis to flag account takeovers, maintainer anomalies, and burst publishing
03Standardized report authoring for executive Triage Cards and full Incident Dossiers
04Threat campaign fingerprinting using an extensive historical JavaScript malware atlas
05Automated IOC clustering, deduplication, and safe defanging across suspected packages
06Downstream blast-radius estimation distinguishing direct dependents, registry downloads, and CDN exposure

Use Cases

01Authoring technical incident dossiers and maintainer chain-of-custody reports for security stakeholders
02Attributing a suspicious npm package or deobfuscated payload to known threat campaigns
03Assessing downstream impact and consumer exposure during an active npm package compromise