Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
mukul975 avatar

Analyzing Supply Chain Malware Artifacts

mukul975/anthropic-cybersecurity-skills

  • 233 installs
  • 27.3k repo stars
  • Updated August 2, 2026
  • mukul975/anthropic-cybersecurity-skills

Analyzing-supply-chain-malware-artifacts is an agent skill that structures supply-chain malware sample analysis into findings, IOCs, and recommendations using a fixed report template.

About

Analyzing-supply-chain-malware-artifacts is a security agent skill that gives solo builders and small security-minded teams a repeatable report skeleton for suspicious dependency or package artifacts. The SKILL content centers on filling structured tables for sample metadata, graded findings, extracted indicators of compromise, and prioritized recommendations—suited when you are investigating a potentially malicious supply-chain sample rather than doing casual code review. It does not replace automated scanners; it standardizes human-led triage so nothing critical is omitted from the write-up. Invoke it when you need a formal analysis memo after obtaining hashes and file types from an incident or hunt. Pair with your own tooling for sandbox execution and verification; this skill packages the documentation ritual.

  • Standard analysis report table for sample SHA-256, type, date, analyst, and TLP:AMBER classification
  • Findings grid with severity and details per row
  • Dedicated IOC extraction table (type, value, context)
  • Numbered recommendations section for remediation follow-up
  • Template-oriented workflow for consistent supply-chain malware write-ups

Analyzing Supply Chain Malware Artifacts by the numbers

  • 233 all-time installs (skills.sh)
  • +11 installs in the week ending Aug 4, 2026 (Skillselion tracking)
  • Ranked #709 of 2,203 Security skills by installs in the Skillselion catalog
  • Security screen: MEDIUM risk (skills.sh audit)
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-supply-chain-malware-artifacts

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs233
repo stars★ 27.3k
Security audit2 / 3 scanners passed
Last updatedAugust 2, 2026
Repositorymukul975/anthropic-cybersecurity-skills ↗

What it does

Structure supply-chain malware sample analysis into a severity-ranked report with IOCs and actionable recommendations.

Who is it for?

Best when you're documenting malware-linked dependency artifacts after initial collection of hash and file type.

Skip if: Routine npm/pip version bumps with no malicious indicators, or fully automated pipeline triage with no human report step.

When should I use this skill?

User needs to analyze or document supply-chain malware artifacts, IOCs, and severity-ranked findings from a collected sample.

What you get

You produce a TLP-aware analysis report with tabular findings, extracted IOCs, and ordered recommendations ready to share with your team.

  • Completed analysis report with sample metadata table
  • Findings table with severity columns
  • IOC list and numbered recommendations

By the numbers

  • Report template includes 3 numbered recommendation slots
  • Structured tables for sample info, findings, and IOCs

Files

SKILL.mdMarkdownGitHub ↗

Analyzing Supply Chain Malware Artifacts

Overview

Supply chain attacks compromise legitimate software distribution channels to deliver malware through trusted update mechanisms. Notable examples include SolarWinds SUNBURST (2020, affecting 18,000+ customers), 3CX SmoothOperator (2023, a cascading supply chain attack originating from Trading Technologies), and numerous npm/PyPI package poisoning campaigns. Analysis involves comparing trojanized binaries against legitimate versions, identifying injected code in build artifacts, examining code signing anomalies, and tracing the infection chain from initial compromise through payload delivery. As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase from prior years.

When to Use

  • When investigating security incidents that require analyzing supply chain malware artifacts
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with pefile, ssdeep, hashlib
  • Binary diff tools (BinDiff, Diaphora)
  • Code signing verification tools (sigcheck, codesign)
  • Software composition analysis (SCA) tools
  • Access to legitimate software versions for comparison
  • Package repository monitoring (npm, PyPI, NuGet)

Workflow

Step 1: Binary Comparison Analysis

#!/usr/bin/env python3
"""Compare trojanized binary against legitimate version."""
import hashlib
import pefile
import sys
import json


def compare_pe_files(legitimate_path, suspect_path):
    """Compare PE file structures between legitimate and suspect versions."""
    legit_pe = pefile.PE(legitimate_path)
    suspect_pe = pefile.PE(suspect_path)

    report = {"differences": [], "suspicious_sections": [], "import_changes": []}

    # Compare sections
    legit_sections = {s.Name.rstrip(b'\x00').decode(): {
        "size": s.SizeOfRawData,
        "entropy": s.get_entropy(),
        "characteristics": s.Characteristics,
    } for s in legit_pe.sections}

    suspect_sections = {s.Name.rstrip(b'\x00').decode(): {
        "size": s.SizeOfRawData,
        "entropy": s.get_entropy(),
        "characteristics": s.Characteristics,
    } for s in suspect_pe.sections}

    # Find new or modified sections
    for name, props in suspect_sections.items():
        if name not in legit_sections:
            report["suspicious_sections"].append({
                "name": name, "reason": "New section not in legitimate version",
                "size": props["size"], "entropy": round(props["entropy"], 2),
            })
        elif abs(props["size"] - legit_sections[name]["size"]) > 1024:
            report["suspicious_sections"].append({
                "name": name, "reason": "Section size significantly changed",
                "legit_size": legit_sections[name]["size"],
                "suspect_size": props["size"],
            })

    # Compare imports
    legit_imports = set()
    if hasattr(legit_pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in legit_pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name:
                    legit_imports.add(f"{entry.dll.decode()}!{imp.name.decode()}")

    suspect_imports = set()
    if hasattr(suspect_pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in suspect_pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name:
                    suspect_imports.add(f"{entry.dll.decode()}!{imp.name.decode()}")

    new_imports = suspect_imports - legit_imports
    if new_imports:
        report["import_changes"] = list(new_imports)

    # Check code signing
    report["legit_signed"] = bool(legit_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)
    report["suspect_signed"] = bool(suspect_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)

    return report


def hash_file(filepath):
    """Calculate multiple hashes for a file."""
    hashes = {}
    with open(filepath, 'rb') as f:
        data = f.read()
    for algo in ['md5', 'sha1', 'sha256']:
        h = hashlib.new(algo)
        h.update(data)
        hashes[algo] = h.hexdigest()
    return hashes


if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <legitimate_binary> <suspect_binary>")
        sys.exit(1)
    report = compare_pe_files(sys.argv[1], sys.argv[2])
    print(json.dumps(report, indent=2))

Validation Criteria

  • Trojanized components identified through binary diffing
  • Injected code isolated and analyzed separately
  • Code signing anomalies documented
  • Infection timeline reconstructed from build artifacts
  • Downstream impact scope assessed across affected systems
  • IOCs extracted for detection and blocking

References

Related skills

microsoftEntra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kmicrosoftAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3kxixu-meOpenclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72better-authBetter Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206firebaseFirebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397squirrelscanAudit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85

How it compares

Use this documentation template instead of free-form chat summaries when you need audit-ready supply-chain malware notes.

FAQ

Who is analyzing-supply-chain-malware-artifacts for?

Developers, SaaS founders, and small teams who investigate compromised packages or artifacts and must report IOCs clearly.

When should I use analyzing-supply-chain-malware-artifacts?

During Ship security when you are analyzing supply-chain malware artifacts and need structured findings, IOC tables, and recommendations before trusting a release.

Is analyzing-supply-chain-malware-artifacts safe to install?

Check the Security Audits panel on this Prism page; handling real malware samples should stay in isolated analysis environments regardless of skill content.

Securityauditappsec
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.