Wiz pipeline flags malicious npm packages before a CVE exists
Original title: Supply Chain Zero Days: Closing the Gap Between Publication and Detection
Wiz says notable supply-chain attacks rose from about 10% of significant incidents in late 2025 to 1 in 4.
Wiz describes a pipeline that downloads new npm versions, compares them with prior releases, and combines static analysis, an AI classifier, sandbox execution, and runtime sensing. Confirmed malicious versions push indicators into Wiz Defend and code and cloud scanning before a formal CVE. In the Axios case, two malicious versions pulled in plain-crypto-js; Wiz says Axios was in about 80% of observed environments and execution was seen in 3%. For keyv, the pipeline caught runtime retrieval of command-and-control domains from an Ethereum contract.
Unconfirmed: Exposure and incident-share figures are Wiz Research observations, not an independent census.
- Malicious Axios versions named were v1.14.1 and v0.30.4, later removed within hours.
- Wiz says Axios was downloaded around 100 million times per week.
- keyv malware queried an Ethereum smart contract for C2 domains instead of hardcoding them.
- The pipeline alerts through the threat intelligence center, scanners, and Wiz Defend.
Impact: Malicious dependency code in development and build environments
| Product | Affected | Fixed in |
|---|---|---|
| npm axios | v1.14.1 and v0.30.4 | malicious versions removed |
| npm keyv | — | — |
- 1.Check environments for Axios v1.14.1, v0.30.4, and the plain-crypto-js dependency.
- 2.Review keyv and cacheable npm packages for the maintainer-account compromise.
- Vendors
- Wiz
- Products
- Wiz Defendaxioskeyvnpm
- Malware
- plain-crypto-js
From the original article
5 min read at wiz.io
When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published
By Alice Klimovitsky · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.