[RRFC] Extend npm audit to detect supply chain compromise signals beyond CVEs

Motivation ("The Why")

The axios compromise on March 31st exposed a gap that npm audit can't close on its own. A threat actor hijacked the primary maintainer's npm account and published two backdoored versions within 40 minutes — each with a previously undeclared dependency running a RAT via post-install. There was no CVE at the time of publish. The advisory database had nothing to flag.

This isn't isolated. In 2025 alone, 45,777 CVEs were reported averaging 130 per day, and multiple npm supply chain attacks hit packages with billions of weekly downloads. A growing share of these attacks arrive before a CVE exists — through account takeovers, dependency injection, and post-install abuse.

Example

A developer runs npm install after a routine package.json update. One dependency received a patch version bump overnight. The bump introduced a new post-install script and was published by an account that had never touched the package before. npm audit returns clean. The machine is compromised within seconds of install completing.

How

Current Behaviour

npm audit queries the advisory database for known CVEs against the resolved dependency tree. It returns clean if no CVEs exist, regardless of other signals.

Desired Behaviour

npm audit (or a new npm audit --provenance / npm audit --supply-chain flag) additionally checks:

• Whether the publish account for each installed version has previously published that package
• Whether new post-install or install scripts were introduced in the installed version vs. the prior one
• Whether new transitive dependencies were introduced that weren't present in the prior version
• Whether the installed version has a valid SLSA provenance attestation, especially for packages that previously carried one

These checks don't require a new database — npm already has publish history and provenance metadata. Surfacing them at audit time gives developers a signal before a CVE is ever filed.

References

• Microsoft Security Blog — Mitigating the Axios npm supply chain compromise
• The Hacker News — Axios Supply Chain Attack Pushes Cross-Platform RAT
• Palo Alto Networks — Widespread npm Supply Chain Attack Puts Billions of Weekly Downloads at Risk
• Related: #739

Start by reviewing the proposed signals and the related issue #739, then trace how the RFC process defines scope for npm audit changes. Done means reaching agreement on the supported signals, their provenance and publish-history requirements, and whether they belong behind a new audit flag or an expanded default behavior.