supply chain compromise — quick-start

checklist

1. identify the exact package name, malicious version, and first-published timestamp from the package registry advisory.
2. pin or yank the affected version from your internal registry or package manager config — prevent new installs.
3. query your CI/CD artifact cache and lock files for builds that pulled the malicious version.
4. identify all production deployments built after the malicious version was published.
5. export package-lock.json, yarn.lock, or requirements.txt from every affected pipeline run for the exposure window.
6. pull code signing certificate logs — did the attacker push a signed release? note cert serial and publisher.
7. export network egress logs for any system that ran builds containing the malicious package — beacon IPs matter.
8. preserve the malicious package tarball from the registry before the registry removes it — hash sha-256.
9. identify all maintainer accounts that had publish access to the affected namespace — note account age and MFA status.
10. begin the primary tool path below — supply chain compromise analyzer and package diff tool.

primary tools

1. 01yara scannerwrite YARA-like rules · scan any file locally · string and byte pattern matching · condition logic · export match report · runs locally
2. 02yara rule scannerwrite YARA rules or use 50+ built-in rules · drop any binary to scan · condition matching · string search · hex patterns · offset anchors · export matches · runs locally
3. 03pe analyzerdrop a Windows executable · parse PE headers · sections · imports · exports · entropy per section · detect packers · imphash · runs locally
4. 04pe static analyzerdrop any .exe · .dll · .sys · parse PE headers · import table · suspicious API categories · section entropy · packer fingerprint · anomaly detection · export report · runs locally
5. 05PE compile timestamp vs filesystem timestamp conflict detectordrop mft csv or file listing with pe headers · extract compile timestamps from pe headers · detect files with filesystem timestamps earlier than their compile timestamp · surface impossible binaries indicating timestomping · runs locally
6. 06imphash calculatordrop a PE file · compute Mandiant-style import hash · list all imports · compare with known samples · runs locally
7. 07binary compiler and language identifierdrop pe elf or macho binaries · identify compiled language · go rust nim python compiled dlang zig · detect compiler version · extract build metadata · language-specific string patterns · runs locally
8. 08source code style forensic fingerprinterdrop source code or decompiled text · analyze indentation · naming · comments · apis · stylometric fingerprint · compare authorship · runs locally

go deeper