Supply Chain Zero Days: Closing the Gap Between Publication and Detection

What it is

A Wiz blog post describing its npm publication-time detection pipeline, with two cases: the Axios compromise and the keyv/cacheable compromise. Wiz says it can flag a malicious version and push detections to Wiz Defend before a CVE is published. The post is vendor material and covers npm only.

How it works

The pipeline runs per new package version, in this order:

1. It downloads and extracts the new version and earlier versions for comparison.
2. Static analysis flags suspicious files, and an AI classifier returns an initial verdict.
3. Suspicious versions go to dynamic analysis: install in a sandbox, import the version and its exposed modules, and run it from the CLI where possible.
4. The Wiz Sensor observes runtime behavior, which confirms the verdict and gives the classifier more evidence.
5. The classifier issues a final verdict. A confirmed malicious version has its IOCs published automatically to the Wiz reputation service.

Customers see the result as threat intelligence center notifications and as auto-updated Wiz Defend detection rules with configurable runtime detection and response policies. Wiz also says it evaluates dependencies at each install or upgrade.

Cases the page gives

• Axios: an unknown actor took over a maintainer's npm account and published v1.14.1 and v0.30.4. Both added a dependency on plain-crypto-js, a newly created malicious package. The versions were removed within hours. Wiz Research says Axios was in about 80% of cloud and code environments and downloaded about 100 million times a week. Execution was observed in 3% of affected environments.
• keyv: several packages in the keyv/cacheable ecosystem were compromised after a GitHub maintainer account takeover. The malware looked up its C2 domains at runtime from an Ethereum smart contract, so no domain appeared in the source. Static analysis could not find the C2. The pipeline saw network traffic to the malicious domain and flagged the package with high confidence, without human intervention.

What to do

The page gives no commands or configuration. Its implied guidance is to check for the two Axios versions and for plain-crypto-js in dependency trees and lockfiles. It also implies that static scanning and CVE matching alone will miss runtime-resolved C2, so runtime network monitoring is needed. Acting on the Wiz detections themselves requires Wiz Defend.

Caveats

• The post gives no detection latency, false-positive rate or coverage figures. It says only that false positives are kept "to a minimum".
• The incident share (about 10% of significant incidents in H2 2025, 25% in H1 2026) comes from Wiz's own research, with no method stated.
• Only npm is described as covered.