Package attack leads from static evidence.

What the scanner sees

• The artifact is unpacked as data and scanned for credential-oriented paths and environment names.
• Hits such as .ssh, .aws, .azure, .npmrc, NPM_TOKEN, and GITHUB_TOKEN are grouped across releases.
• A single mention is treated as package evidence; repeated hits across packages become campaign evidence.

Research read

This is the pattern I would expect from a credential-harvesting payload before it phones home. The important part is the search target, not the language used to implement it.

Operational response

Block by default, inspect the exact files, and rotate matching secrets if the package reached a developer or CI host.

What the scanner sees

• PkgRadar counts high-risk releases tied to the publisher key and tracks member growth over time.
• The campaign record is promoted when expansion or score increases create a durable candidate.
• Package examples remain linked so the analyst can distinguish legitimate release trains from suspicious bursts.

Research read

The publisher key is a lead, not a verdict. The useful question is whether a trusted release path suddenly started shipping behavior that previous releases did not.

Operational response

Review recent releases together, compare to normal cadence, and require maintainer confirmation before relaxing CI policy.

What the scanner sees

• Manifest scripts are parsed without invoking npm, node, shell, or package manager hooks.
• Commands that invoke interpreters, fetch remote content, or suppress failures are separated into explicit TTPs.
• Repeated install-time behavior across packages becomes a candidate even when the exact script text differs.

Research read

The dangerous property is execution timing. If a package can run during dependency installation, the blast radius includes developer laptops, CI workers, and release automation.

Operational response

Gate install hooks, require manual approval for new lifecycle scripts, and prefer lockfile or mirror enforcement.

What the scanner sees

• The scanner looks for DNS resolver usage and known out-of-band interaction domains in source text and manifest scripts.
• The evidence is stored as a static indicator; PkgRadar does not resolve domains or execute callbacks.
• Repeated resolver or OAST indicators across packages are grouped as an exfiltration candidate.

Research read

This is not proof of theft by itself, but it is exactly the sort of primitive I would prioritize when combined with credential discovery or install-time execution.

Operational response

Block the release, inspect for adjacent credential collection, and review egress logs if the package was installed.

What the scanner sees

• The manifest is parsed as JSON and dependency fields are checked for remote specs.
• Remote artifacts can be followed statically within bounded fetch limits.
• The remote target becomes correlation evidence when multiple packages point at the same infrastructure.

Research read

This is often legitimate in development packages, but it is a weak link in production dependency policy because the trust anchor has moved.

Operational response

Pin, mirror, or block remote dependency specs until the target repository and commit are reviewed.