Incident Playbooks

Step‑by‑step actions for common npm threat scenarios.

Postinstall downloads a binary

Block PR/update. Capture the tarball and diff recent versions.
Stops propagation while you verify what changed and whether payload is legitimate.
Verify host: must be trusted GitHub Releases/CDN. If unknown, treat as malicious.
Attackers commonly host payloads on throwaway domains to avoid scrutiny.
Look for obfuscation and child_process launches. Remove the dependency if non‑essential.
Hidden behavior plus shell execution is a strong indicator of malware.
Quarantine build containers; rotate tokens if any env secrets were accessible.
If the payload ran, credentials may be compromised; rotate to be safe.

Check maintainers and repo; confirm legitimate lineage.
Typosquats often have unknown maintainers or no real upstream project.
Inspect README and code size; tiny or empty repos are red flags.
Malicious packages minimize content and hide behavior in postinstall.
Replace with the intended package; add allow‑lists to prevent recurrence.
Prevents future accidents in CI and developer machines.

Pin to last known‑good version; block auto‑upgrades.
Freezes to a safe state while investigation proceeds.
Audit changes in the compromised release: look for obfuscation, network I/O, or env access.
These are common attacker behaviors in compromised releases.
Run builds with --network=none and scrubbed HOME until confidence restored.
Limits blast radius and stops exfil while you assess.
Monitor maintainer activity; require two‑person review for re‑adoption.
Adds friction and oversight for future releases.

Assume high risk. Identify exact command and purpose.
Shell commands during install can touch filesystem, network, and secrets.
If purely build‑related and host chain is trusted, isolate and whitelist.
Some native builds need compilers; whitelist only after verification.
Otherwise, remove or replace the dependency; report to registry/security teams.
Prevents propagation and helps the ecosystem respond quickly.

Capture logs; identify which package initiates outbound connections.
Pinpoints the source for targeted mitigation.
Run with --network=none; confirm build still succeeds.
Proves whether network access is truly required.
Allowlist domains if needed and verify checksums/signatures.
Minimizes exposure when network dependency is legitimate.

Freeze to last known‑good version; audit diffs of latest release.
Stabilizes while you verify new ownership.
Check repo activity and communication; look for transparency.
Legitimate handovers are usually documented.
Require two‑person review for first re‑adopted versions.
Adds oversight during the riskiest period.