Supply chain - install and import-time hook behaviour

supply-chain-install-hook-behavior is a critical severity check in the tooling category, written in shell. Its source is templates/tooling/supply-chain/supply-chain-install-hook-behavior.sh in cert-x-gen-templates.

What it checks

Installs a package with a real package manager inside a hermetic lab and observes what the install, the interpreter startup and the first import actually DO - outbound network egress, writes outside the install prefix, and reads of planted decoy credentials. Every observation is differential against the same package manager performing the same phase on a synthesised inert package, so only side effects attributable to the package under test are reported. Behavioural, not signature-based: it never looks at the hook’s source.

There is a playbook for this check

Install-time credential access and workflow planting sets out the use case, the probe flow, the oracle, and the fixture that proves it in both directions.

Header

Field	Value
Id	supply-chain-install-hook-behavior
Severity	critical
Language	shell
Category	tooling
Author	CERT-X-GEN / Bugb Technologies
Template version	not recorded
Confidence	95
CVSS	not recorded
Weakness	CWE-506
Tags	supply-chain, tooling, npm, pypi, install-hook, postinstall, pth-file, malicious-package, behavioural
Target kind	cli
Oracle	property, diff, detector

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://www.zscaler.com/blogs/security-research/supply-chain-attacks-surge-march-2026

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info supply-chain-install-hook-behavior

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• tooling is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.