How `shieldcortex audit –deps` Catches the parikhpreyash4 Supply-Chain Attack

yazar

Socket Security flagged a campaign yesterday: roughly 700 GitHub repositories carrying a poisoned package.json that drops /tmp/.sshd, pipes curl -skL … to a shell, and — the cute bit — injects a fake “Dependency Cache Sync” step into the project’s GitHub Actions workflow so the payload re-runs on every CI build.

Top hits include devdojo/wave and devdojo/genesis. The bad actor is parikhpreyash4; the bait repo is systemd-network-helper-aa5c751f.

I checked my own machines this morning. Clean. But that’s not the interesting bit — the interesting bit is that the same scanner that audits AI agent memory also catches this class of attack before npm install ever runs.

The one-liner

npm install -g shieldcortex
shieldcortex audit --deps

That’s it. Run it in any project root. The --deps flag points the existing audit pipeline at ./node_modules and looks for three things:

  1. Known-malicious packages from an in-repo blocklist (CRITICAL).
  2. Typosquats — names within Levenshtein distance ≤ 2 of popular packages like axios, express, react, crypto-js (HIGH).
  3. Suspicious install/preinstall/postinstall scripts — curl, wget, child_process, os.platform, rm -rf, .ssh, .aws, .npmrc, process.env, and 13 more patterns (HIGH/MEDIUM).

What it catches on the parikhpreyash4 payload

I built a one-file reproducer of the bait package — same name as the live one, same script shape — and pointed the scanner at it: 

shieldcortex audit --deps-path /tmp/sc-demo/node_modules

Output, trimmed: 

✗  Dependency Scanner        3 finding(s) (2 scanned)  4ms

[!] HIGH    Possible typosquat: "axois" → "axios"
   "axois" is 1-2 characters away from the popular package "axios".
   File: /tmp/sc-demo/node_modules/axois/package.json

[!] HIGH    Suspicious install script in "axois"
   "axois" has an install/postinstall script containing suspicious patterns:
     curl (payload download), HTTP/HTTPS URL.
   File: /tmp/sc-demo/node_modules/axois/package.json

[!] HIGH    Suspicious install script in "systemd-network-helper-aa5c751f"
   "systemd-network-helper-aa5c751f" has an install/postinstall script containing
   suspicious patterns:
     curl (payload download), HTTP/HTTPS URL, .ssh (SSH key access).
   File: /tmp/sc-demo/node_modules/systemd-network-helper-aa5c751f/package.json

Four-millisecond scan. Two packages. Three findings. Including the exact parikhpreyash4 bait repo name — flagged not by reputation, but by the shape of its install script.

What it doesn’t do (so I don’t oversell it)

  • It does not scan your live filesystem for /tmp/.sshd or other post-compromise artefacts. That’s an EDR job, not a dependency-audit job. (I used a separate sweep for that.)
  • It does not read your .github/workflows/*.yml to spot the fake “Dependency Cache Sync” injection — yet. That’s queued for the next release.
  • The typosquat detector is heuristic, not omniscient. It catches axois, expreess, react-dom-utils-style bait. It won’t catch a brand-new, distinct package name that no one’s flagged yet.

What it does do is fail loudly the moment a poisoned package with an install script lands in your node_modules. That’s the window you actually care about: between npm install writing files to disk and postinstall getting its hands on a shell.

Wire it into CI

- name: ShieldCortex dependency audit
  run: |
    npm install -g shieldcortex
    shieldcortex audit --deps --ci

--ci exits non-zero on any CRITICAL or HIGH finding, so a poisoned package fails the build instead of shipping. Optional flags:

  • --auto-protect — moves CRITICAL packages to a quarantine directory automatically.
  • --quarantine — same, but for HIGH too.
  • --clean --force — permanently deletes CRITICAL packages (non-recoverable; only safe in ephemeral CI runners).

The bigger pattern

The parikhpreyash4 campaign isn’t novel. Same shape as event-stream, flatmap-stream, the recent @anthropic/claude-code-utils typosquat — package author gets compromised or impersonated, malicious code lives in postinstall, victim’s CI runs it on the next push.

The only thing that’s changed is the cadence. We’re seeing this attack class every few weeks now. The remediation is the same every time: scan dependencies before you trust them, fail builds on suspicious install scripts, and don’t let postinstall run as a privileged user on your own laptop.

shieldcortex audit --deps is one way to do that. There are others. Pick one and wire it in this week.

ShieldCortex is open-source — repo at github.com/Drakon-Systems-Ltd/ShieldCortex. The --deps scanner lives in src/audit/dependency-scanner.ts if you want to read what it actually does.