Wiz Detects Supply Chain Zero Days Before CVE Publication Using AI Analysis

Wiz published new research detailing how its supply chain detection pipeline identifies compromised software packages at the moment of publication. The system flags malicious code in npm packages before formal CVE identifiers are issued, allowing security teams to block threats earlier in the development lifecycle.

The company states that speed is critical because malicious updates to trusted packages often enter build pipelines before vulnerability databases reflect the risk. Traditional scanning methods rely on known vulnerability data, which leaves a window of exposure for zero-day supply chain compromises. By analyzing packages immediately upon release, Wiz aims to close this detection gap.

Rising Threat Frequency

Supply chain attacks are becoming a dominant vector for significant security incidents. According to Wiz Research, these attacks accounted for approximately 10% of notable incidents in the second half of 2025. That figure increased to 25% in the first half of 2026, meaning one in four significant security events now involves a supply chain compromise.

This trend highlights the difficulty of defending against rapid software adoption. Developers and AI coding agents frequently pull new dependencies to accelerate shipping, creating challenges for security teams. Organizations cannot manually review every update to foundational packages without slowing development, yet automated trust in popular packages creates significant exposure.

Analysis of the Axios Compromise

The Axios package compromise serves as a recent example of this risk. An unknown threat actor compromised the npm account of an Axios maintainer and published two malicious versions, v1.14.1 and v0.30.4. These versions introduced a dependency on plain-crypto-js, a newly created malicious package.

Although the malicious versions were removed within hours, the threat persisted. At the time of the incident, Axios was present in approximately 80% of cloud and code environments, with around 100 million weekly downloads. Wiz observed execution of the malicious code in 3% of affected environments, demonstrating how popularity enables rapid exposure even when remediation is swift.

Automated Detection Pipeline

Wiz built a dedicated pipeline to analyze new packages and versions as soon as they are published to npm. When a new version is released, the system downloads and extracts it for comparison against previous versions. Static analysis techniques flag suspicious files, feeding data into an AI classifier engine that returns an initial verdict.

Suspicious versions undergo dynamic analysis to validate the initial findings. This process includes installing the package in a sandbox environment to monitor runtime activity and running the package from the command line where possible. The Wiz Sensor observes this behavior to confirm malicious activity, providing additional evidence to the AI classifier for a final verdict.

Once a version is confirmed as malicious, the pipeline automatically publishes indicators of compromise to the Wiz reputation service. This ensures customers receive alerts via the threat intelligence center as soon as the package enters their environment. This proactive approach allows teams to understand impact before traditional advisories are issued.

As Threat Times reported on October 18, 2026, former SolarWinds CISO Tim Brown detailed how the 2020 Sunburst breach bypassed source code controls, impacting nearly 18,000 customers globally. That historical context underscores the ongoing difficulty of securing build supplies against sophisticated supply chain attacks.

What should you do?

Security teams should prioritize reducing the window of exposure between package publication and detection. Since zero-day compromises may not appear in traditional vulnerability databases immediately, relying solely on known CVE scanning leaves environments vulnerable. Organizations should evaluate tools that offer real-time or near-real-time analysis of new package versions.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: Wiz

• Monitor for new package versions from critical dependencies immediately after publication rather than relying on delayed CVE updates.
• Implement sandboxed dynamic analysis for newly downloaded packages to detect runtime malicious behavior before deployment.
• Review build pipeline configurations to ensure they do not automatically trust and execute the latest versions of popular packages without verification.
• Subscribe to threat intelligence notifications that alert on compromised packages as soon as they are identified by security vendors.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does Wiz detect malicious packages before a CVE is published?

Wiz uses a dedicated pipeline that performs static and dynamic analysis, including sandboxed runtime monitoring, on new npm package versions immediately upon publication.

What percentage of significant security incidents are supply chain attacks in H1 2026?

According to Wiz Research, supply chain attacks accounted for 25% of significant security incidents in the first half of 2026.

What happened during the Axios package compromise?

An attacker compromised an Axios maintainer's npm account and published two malicious versions that introduced a dependency on a new malicious package called plain-crypto-js.