# AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scale

> On August 4, 2026, AWS announced Supply Chain Security as the 10th category in Security Hub Extended, with Socket and Chainguard as curated partners. This marks the formal recognition of supply chain security as a first-class cloud security discipline on AWS, addressing a threat landscape where open-source malware detections rose 73% year-over-year in 2025 and over 1.8 million malicious packages have been documented across npm, PyPI, Maven, NuGet, and Crates.io.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1867
- **ID:** TL-2026-1867
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AWS Security Hub Extended has introduced Supply Chain Security as its 10th security category, onboarding Socket (socket.dev) and Chainguard as curated partner solutions. This integration brings deep behavioral analysis of open-source dependencies — including real-time malicious package detection at install time — into the AWS Security Hub console with consolidated billing and OCSF-formatted findings. Socket provides two products: Socket Firewall, which blocks malicious open-source packages at install time before they reach laptops, CI pipelines, or agent sandboxes (priced on unique artifacts checked per month), and Socket Software Composition Analysis (SCA), which provides visibility into open-source risk across shipped software (per-user pricing). Socket's detection engine uses three complementary techniques: static analysis of 70+ security red flags (install scripts, network requests, environment variable access, obfuscated code, privileged API usage), package metadata analysis (typosquatting via Levenshtein distance + download ratio comparison, HTTP dependencies, unstable ownership), and maintainer behavior analysis (out-of-order version publishing, sudden new maintainer permissions, trivial packages with suspicious refactors). The Firewall operates across npm, PyPI, Maven, Go, NuGet, and RubyGems ecosystems. Chainguard brings proactive malware prevention through hardened container images and libraries, with existing Amazon Inspector integration for CVE scanning.

The threat landscape driving this integration is severe. Sonatype's State of the Software Supply Chain 2026 reports over 1.8 million cumulatively documented malicious packages across open-source ecosystems, with 454,600+ new malicious packages discovered in 2025 alone — a 73% increase from 2024 per ReversingLabs. npm dominates as the primary attack vector, accounting for over 99% of open-source malware in 2025, with npm malware detections more than doubling from 5,290 (2024) to 10,819 (2025). The Shai-Hulud campaign (September 2025) introduced the first self-replicating npm malware, compromising approximately 1,000 packages and exposing ~25,000 GitHub repositories to malicious code injection — followed by Sha1-Hulud (November 2025). Nation-state actors have industrialized their approach: the Lazarus Group (APT38) had over 800 associated malicious packages identified in 2025, 97% on npm, evolving from simple droppers to five-stage payload chains combining credential theft and persistent remote access.

Major campaigns Socket has detected demonstrate the sophistication of modern supply chain attacks. The Mastra npm compromise (June 17, 2026) weaponized 141 @mastra/* packages — @mastra/core has 918K weekly npm downloads — via a single typosquatted transitive dependency (easy-day-js, a typosquat of dayjs). The attack deployed a two-stage implant: a self-deleting obfuscated loader (setup.cjs) that disabled TLS verification and beaconed to C2 at 23.254.164.92:8000, followed by a 41 KB cross-platform Node.js backdoor (protocal.cjs) with OS-specific persistence (Windows Run key, macOS LaunchAgent, Linux systemd user unit) and capabilities including cryptocurrency wallet inventory across 166 browser extensions, browser history theft from Chrome/Edge/Brave, and full remote tasking via a custom ICAP-style protocol. The TrapDoor campaign (May-June 2026) spanned 34+ malicious packages and 384+ versions across npm, PyPI, and Crates.io, using a shared 48 KB payload (trap-core.js) that deployed through postinstall hooks (npm), auto-execution on import (PyPI), and build.rs compilation scripts (Crates.io). It exfiltrated developer credentials, crypto wallets, SSH keys, and cloud credentials, planted persistence through .cursorrules, CLAUDE.md, git hooks, systemd, and cron, and attempted SSH-based lateral movement. The Nx build system compromise (August 2025) injected malicious versions into the Nx build tool (4.6M weekly npm downloads) via GitHub Actions workflow injection and npm token theft, weaponizing AI developer CLI tools (Claude, Gemini, Q) for filesystem reconnaissance. The TanStack compromise (2025) hit 84 npm artifacts with credential stealers targeting CI systems.

All findings from Socket and Chainguard are emitted in the Open Cybersecurity Schema Framework (OCSF) format — currently OCSF schema version 1.6 — and automatically aggregated in AWS Security Hub. This standardization enables security teams to treat supply chain findings (malicious packages, risky dependencies, compromised maintainers) consistently alongside endpoint, identity, network, and cloud security findings within a single console. The integration is available in all AWS commercial Regions where Security Hub is offered, with pay-as-you-go pricing with no long-term commitments, and existing AWS committed spend can be applied toward Socket and Chainguard usage. AWS Security Hub Extended now encompasses 23 curated partner solutions across endpoint, identity, email, network, data, browser, cloud, AI, security operations, and supply chain security categories.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1518 Software Discovery
- T1033 System Owner/User Discovery
- T1563 Remote Service Session Hijacking
- T1570 Lateral Tool Transfer
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1095 Non-Application Layer Protocol
- T1567 Exfiltration Over Web Service

## Sources

- [AWS Security Hub Extended Adds Supply Chain Security as Its 10th Category](https://aws.amazon.com/about-aws/whats-new/2026/08/aws-security-hub-extended-adds-supply-chain-security/)
- [Socket + AWS Security Hub Extended Integration](https://socket.dev/blog/aws-security-hub-socket)
- [Sonatype State of the Software Supply Chain 2026](https://www.sonatype.com/state-of-the-software-supply-chain)
- [ReversingLabs Software Supply Chain Security Report 2026](https://www.reversinglabs.com/resources/software-supply-chain-security-report)
- [Mastra npm Packages Compromised — Supply Chain Attack Analysis](https://socket.dev/blog/mastra-npm-packages-compromised)
- [TrapDoor Crypto Stealer — Cross-Ecosystem Supply Chain Attack](https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates)
- [Nx Build System Supply Chain Compromise Analysis](https://socket.dev/blog/nx-build-system-compromised)
- [Shai-Hulud Self-Replicating npm Malware Analysis](https://socket.dev/blog/shai-hulud-self-replicating-malware)
- [TanStack npm Package Compromise — CI Credential Theft](https://socket.dev/blog/tanstack-npm-compromise)
- [Open Cybersecurity Schema Framework (OCSF) Documentation](https://ocsf.io/)
- [AWS Security Hub Pricing](https://aws.amazon.com/security-hub/pricing/)
- [AWS Security Hub Extended Partners Overview](https://aws.amazon.com/security-hub/partners/)
- [CISA Known Exploited Vulnerabilities — Software Supply Chain](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1867