Why Conventional Reputation Feeds Miss Software Supply Chain Attacks

What it is

OpenSourceMalware's measurement of how poorly reputation feeds cover supply chain attack infrastructure. It uses two cohorts: 450 network indicators (229 domains, 166 URLs, 55 IPs) checked at ingestion between 2 October and 2 November 2026, and 174 verified indicators from ten campaigns (March to October 2026) queried in a November 2026 snapshot.

What the numbers add

• Day zero by type: the share at or below 2 VirusTotal detections was 77.1% for payload URLs, 66.8% for C2/staging domains and 67.3% for IPs. The page notes that many SOAR and SIEM rules ignore anything under 3 detections.
• Payload files are worst: of 107 malicious scripts in the retrospective set, 49 were never uploaded to VirusTotal (404) and 45 were scanned clean. Together that is the 87.9% figure. The page's example is a Keyv credential-harvesting payload (SHA256 ad111858f73ef39e955ea4a6cdc83d92b53d5ca0248a94095ff0448c7b147e29) with 0 of 63 detections, while the headline dropper setup.mjs reached 24.
• Campaign spread is wide: blind-spot rates were AntV 100%, PyPI stealer clusters 94.7%, TrapDoor 84.2%, Contagious Interview 76.9%, PolinRider 73.7%, Keyv/Cacheable 66.7%, Trivy/TeamPCP 58.3%, Axios 57.1%, IDE extensions 52.9% and Mini Shai-Hulud 46.7%. Excluding 13 abused shared services (webhook.site, rentry.co, GitHub release links), the overall rate is 71.4% (115 of 161).
• Other feeds on the 54 attacker-controlled network indicators: VirusTotal flagged 18 (66.7% blind). urlscan.io had a blind rate of 87.0% and scanned 12 of 54. AbuseIPDB flagged 6 (88.9% blind). URLhaus flagged 1 (98.1% blind). Every hit from these three was already in VirusTotal's detected set. RDAP marked 11 of 38 domains (28.9%) as newly registered, but that is a heuristic, not a verdict.
• Day-zero infrastructure traits: over 60% of staging domains were under 14 days old or on Vercel, Render or Netlify preview subdomains. Over 90% had no AbuseIPDB reports. Only about 15% had ever been scanned by urlscan.io.

Why it happens

Attacks run outbound from developer machines and CI runners, so perimeter-fed engines never see them. Attacker infrastructure is quiet and short-lived, so volume-based feeds never build a reputation. Payloads are short interpreted scripts whose malice depends on running inside an install hook. Of the 67 network indicators in the retrospective set, 13 (19.4%) were legitimate developer services such as Telegram bot APIs, GitHub raw content and webhook listeners.

What to do

The page's triage steps, in order:

1. Inspect lifecycle hooks (preinstall, postinstall, binding.gyp, tasks.json, setup.py) for child processes, base64 evaluation or network calls. Network activity in a hook is almost always anomalous.
2. Check publisher provenance: an unvetted maintainer, a version with no matching commit or tag upstream, or a surprise patch on a dormant project. Package age is not a safe signal.
3. Trace where any outbound request went. Treat raw IPs, ephemeral serverless subdomains, webhook listeners and non-registry endpoints as indicators.
4. If code ran, assume exfiltration and rotate CI environment variables, cloud IAM tokens, registry publishing keys, .env files, AI service logins and SSH/GPG keys.

For spot-checking, the page lists one public IOC per campaign, including sfrclak.com (Axios), verify.build-standards.org (TrapDoor), x.oast.fun (AntV), git-tanstack.com (Mini Shai-Hulud), stanionstudios.com (Contagious Interview), 166.88.134.62 (PolinRider), status.oastify.com (PyPI stealers), holiday-themes.dev (IDE extensions) and csec-supply-chain-attack-1tcq.onrender.com (Trivy/TeamPCP).

Caveats

• The indicators come from the vendor's own analysis engine, so the sample is not independent.
• The vendor's own numbers differ in places: the URLhaus miss rate is 96.3% in one passage and 98.1% in the table, and VirusTotal engine counts are given as up to 75 and up to 92.
• The page offers no detection rule or tooling to replace the feeds beyond the manual triage list.