SBOMATOR
⌂
Catching the next keyv-style npm attack — at scan time, at install time,
and before any vendor publishes an advisory
ESL — Engineering Software Lab | SBOMator 1.4.x | August 2026
www.eswlab.com | sales@eswlab.com
SBOMator by ESL — Engineering Software Lab is a software supply-chain evidence platform: it discovers everything your product is built from, checks it against vulnerability and malware intelligence, and turns the result into audit-ready compliance evidence.
Generates CycloneDX SBOMs: direct and transitive dependencies, versions, suppliers, licenses, PURLs and resolvable hashes — the full ingredient list of your software.
Correlates every component with NVD, OSV and Grype, adds CISA KEV exploitation status and FIRST EPSS prioritization, and records VEX affected / not-affected decisions.
Hash-chained, tamper-evident audit history and ready-made evidence packs for the EU Cyber Resilience Act and FDA Section 524B (medical devices).
Endpoint monitoring inventories installed software, packages, runtimes and even AI-agent extensions — with rescans, integrity drift and new-CVE alerts.
Core philosophy: know what is in your product, know what changed, prove what you did.
| Layer | What SBOMator analyzes |
|---|---|
| Source & vendored code | CMake projects, includes, SDK paths, known-library source signatures |
| Binaries | .a • .lib • .so • .ko • .o + symbol analysis, cross-architecture: ARM, AArch64, RISC-V, MIPS, Xtensa, PowerPC |
| Firmware images | HEX, U-Boot, SquashFS, CPIO, EXT4 — with Yocto and Zephyr Kconfig-aware analysis |
| Package ecosystems | npm, PyPI, vcpkg, Conan, NuGet, Scoop, Chocolatey and more |
| Hardware (HBOM) | Xilinx MPSoC / Vivado designs: HDL, IP cores, bitstreams join the evidence graph |
| AI / ML (AI-BOM) | Models, CUDA/TensorRT stacks, agent skills — G7 SBOM-for-AI minimum elements |
| Endpoints | Installed software, runtimes, MCP servers and AI-agent skills on developer machines |
Built for embedded and regulated products: Yocto, Zephyr, embOS, ThreadX, FreeRTOS — where the riskiest components never appear in any package manifest.
Desktop dashboard + CLI on your own machines. Offline / air-gapped modes with local NVD, OSV and KEV mirrors — PUBLIC, HYBRID, PRIVATE or fully LOCAL, no cloud upload required.
Build-aware firmware analysis recognizes backported security fixes in Yocto and Zephyr instead of naively matching version numbers.
HalluSquatting protection against hallucinated package names, plus security scanning of AI-agent skills and MCP servers.
Local fingerprinting with a privacy gate that strips secrets before any external lookup — similarity evidence without blind disclosure.
And new in 1.4: the real-time supply-chain threat detection layer this presentation is about — starting with the attack that proved why it matters.
A compromised maintainer account poisoned keyv, cacheable, flat-cache, file-entry-cache and their family — foundational npm packages that arrive through chains like eslint → file-entry-cache → flat-cache → keyv.
The malware sat in public Git history for 33 minutes before it ever reached npm — and spread for hours before most teams heard about it.
The attacker poisoned the source; the legitimate CI pipeline built, signed and published it. Provenance on keyv@6.0.0 was genuine.
No CVE existed. Vulnerability databases describe bugs, not freshly published malware.
The payload used only legitimate signed binaries — node and the official Bun runtime from GitHub. Normal developer behavior, nothing anomalous to flag.
The only thing that worked: knowing keyv@6.0.0 itself is malicious, or spotting the suspicious preinstall hook it introduced. That is exactly what SBOMator 1.4 adds.
| Time (UTC) | Who | What |
|---|---|---|
| 09:08 | SBOMator | Repo-watch detection of the new install hook - before npm publish |
| 09:35 | npm registry | keyv@6.0.0 publish event (raw signal) |
| ~09:41 | Socket (automated) | Scanner flags the preinstall hook — ~6 minutes after publish |
| morning | SafeDep, Aikido feeds | Real-time publish-event capture, subscriber feeds |
| ~13:45 | Wiz | First comprehensive public report + IOC CSV |
| hours | OSV.dev | Canonical MAL-* advisories (MAL-2026-11524 for keyv) |
Lesson: real-time detection came from registry-metadata monitoring — new version → check lifecycle scripts → alert in minutes. Not from any cloud security platform. SBOMator 1.4 implements this exact mechanism on your endpoint.
Every component is checked against OpenSSF MAL-* malicious-package advisories. Vendor-neutral, covering npm, PyPI, Go, crates.io, RubyGems, Maven, NuGet and more — one batched API call per 1,000 components.
Every npm package added or changed on the machine is checked within 30 seconds against built-in IOCs, cached Wiz feeds, and a live OSV query.
Flags any new version that introduces a preinstall/install/postinstall script its previous release didn't have — the exact keyv pattern, detected with no threat feed at all.
What changed between clean keyv@5.6.0 and malicious keyv@6.0.0:
"scripts": {
"build": "tsdown",
+ "preinstall": "node setup.mjs" ← the entire attack
},
"files": [ "dist", "LICENSE",
+ "setup.mjs", "Math_Symbol.js" ]
Live run of SBOMator 1.4 against the actual incident packages:
OSV keyv@6.0.0: OSV malicious-package advisory (MAL-2026-11524)
OSV keyv@5.6.0: clean
SBOM scan: keyv 6.0.0 <- Built-in IOC Database
SBOM scan: keyv 6.0.0 <- OSV.dev / OpenSSF malicious-packages
Red CRITICAL SUPPLY CHAIN THREAT banner + table: package, version, threat, source, required action
metadata.esl_threat_detection summary and per-component esl_threat_intelligence blocks with OSV IDs
Offline scans fall back to the built-in IOC database and local caches (~\.esl-sbomator\threat_intel\, 6-hour refresh).
| Alert | Meaning | Action |
|---|---|---|
| MALICIOUS | Known-bad version (IOC feeds or live OSV) | Remove immediately + rotate credentials |
| SUSPICIOUS | New install hook vs previous release | Review before trusting |
Positioning: this is not an EDR replacement — it's the supply-chain layer your EDR is blind to. EDR watches what code does; SBOMator watches what enters your software supply chain. The keyv payload looked completely benign to behavior-based tools.
The worm reached its 2nd–12th victim organizations between 10:12 and 13:18 UTC — hours of window where an early alert prevented compromise entirely.
OSV malware check in every scan • real-time endpoint watcher with live OSV • install-hook zero-day heuristic • multi-source IOC corroboration • keyv attack demo & sample client report
ESL — Engineering Software Lab
SBOMator: the supply-chain detection layer your EDR can't see.