npm supply-chain attacks can start with a misspelled package name, a public package that impersonates a private one, a compromised maintainer account or an unsafe build workflow. The risk grows when attackers use the trust and automation already attached to packages to reach developers and downstream projects. Recent incidents show that this can include automated propagation, but the methods and impact vary by package and campaign.
How do npm supply-chain attacks work?
npm identifies several distinct threats: malicious lookalike packages, dependency confusion, and malicious changes to established packages. These are different routes into a project, not interchangeable names for one attack. Attackers may also target the accounts and automation that control publishing or building code.
As an Amazon Associate I earn from qualifying purchases.
Typosquatting: a lookalike package name
An attacker publishes a package with a name resembling a popular one and relies on a developer or configuration file to select it by mistake. A typo in an install command or dependency declaration can be enough. npm says it can detect and block typosquat packages, but that does not establish that every malicious package will be detected; developers still need to verify package names and changes.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Dependency confusion: a public package impersonates a private one
An attacker registers a public package using the name of an organization’s private package. Depending on package-manager configuration, a project may obtain the public package instead of the intended private one. npm recommends scoped packages to reduce this substitution risk and says it cannot detect dependency-confusion attacks.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Compromised package: malicious code in a legitimate release
Instead of inventing a name, an attacker gains publishing access to a real package and adds malicious behavior to a new version. The package’s existing reputation and its place in other projects’ dependency graphs can make the release consequential. What the malicious code does depends on its payload and when and where it runs; one incident’s behavior should not be assumed for another.
Account takeover and CI workflow compromise
npm identifies phishing and expired email domains among the routes attackers may use to take over maintainer accounts. Public package metadata can retain an old email address after a maintainer changes it, so judging account risk from that metadata alone can produce false positives. npm says it checks for expired domains or invalid MX records and restricts password resets in those cases.
A project’s build workflow is another target. GitHub’s July 28, 2026 account of supply-chain attacks describes “pwn request” patterns in which workflows process code from untrusted forks. If a workflow runs that code in a privileged context, the build environment may expose credentials or other access the untrusted contributor should not have.
Recommended Free Tools
Why attacks can spread beyond one package
A package release is often installed and built automatically by projects that depend on it. If an attacker can publish through a legitimate maintainer account, existing trust can become a distribution route. If an install or build also exposes credentials, those credentials may enable further publishing or access to other systems. This chain—rather than any single technique—is what makes some incidents look industrialized.
Rank #3
The evidence supports industrialization where incidents document automation, propagation, scale or repeated compromise patterns; it does not show that every npm incident has the same operator or method. OpenSSF, as reported by Google Cloud in 2025, identified a 1,444% increase in malicious open-source packages from 2024 to 2025. That figure concerns open source broadly, not npm alone.
What recent incidents show—and what their numbers mean
Shai-Hulud: self-replication through compromised accounts
GitHub said it was notified on September 14, 2025, of Shai-Hulud, a self-replicating worm that entered npm through compromised maintainer accounts and malicious post-install scripts. GitHub reported removing more than 500 compromised packages and said npm blocked uploads containing the campaign’s indicators of compromise.
In a September 23, 2025 alert, CISA wrote: “A self-replicating worm—publicly known as ‘Shai-Hulud’—has compromised over 500 packages.” CISA described credential scanning, theft of GitHub personal access tokens and cloud-service API keys, and credential exfiltration. It said attackers then used compromised developer access to infect and publish further packages. The reported package count describes compromised packages, not a count of infected developer machines or confirmed downstream deployments.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →[email protected]: a payload with a specific execution context
A GitHub-reviewed advisory says the color npm publishing account was taken over after phishing on September 8, 2025. Version 5.0.1 added a payload that attempted to redirect cryptocurrency transactions in browser environments. The advisory says local, server and command-line environments were not affected by this specific payload. It lists 5.0.2 as patched and advises removing node_modules, cleaning the package-manager cache, rebuilding browser bundles and purging compromised versions from private registries or mirrors. This was a package-specific browser payload, not evidence that every compromised package steals credentials or behaves like Shai-Hulud.
Best Value
Axios: a short exposure window is not an infection count
Google Threat Intelligence Group (GTIG) reported that social engineering compromised the Axios maintainer account in March 2026, enabling publication of malicious versions. GTIG said the releases were removed within three hours. It also reported that Axios had more than 100 million weekly downloads and was a dependency of tens of thousands of packages. Those figures describe potential reach and ecosystem importance, not confirmed malicious installations. GTIG said it supported affected customers in at least 15 industry verticals and 13 countries; that response scope is likewise not a count of confirmed infections.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to protect an npm project at each stage
No single control covers account takeover, dependency selection, CI exposure and malicious runtime behavior. npm and GitHub describe layered defenses because supply-chain incidents can chain weaknesses together.
| Attack stage | Practical controls | What the control does not establish |
|---|---|---|
| Maintainer account | Enforce strong multifactor authentication, protect account-recovery routes and treat unexpected support or reset requests as suspicious. npm describes phased mandatory 2FA and enhanced login verification. | 2FA does not make a compromised session, recovery route or publishing workflow harmless. |
| Package publishing | Prefer short-lived, narrowly scoped credentials and trusted publishing where supported. GitHub’s 2025 plan described required 2FA for local publishing, seven-day granular tokens, trusted publishing, and deprecation of classic tokens and TOTP 2FA as planned hardening. | The 2025 plan was a roadmap, not proof that every measure had shipped then. GitHub’s later 2026 update describes subsequent mitigation changes; check current npm and GitHub policy before relying on a particular control or rollout. |
| Dependency resolution | Use scoped package names for private namespaces. Review names, maintainers, versions, lifecycle scripts and unexpected dependency changes before adoption or upgrade. | Scopes address public/private name substitution risk; they do not by themselves prevent a legitimate package or account from being compromised. |
| CI workflows | Avoid running untrusted pull-request code with privileged credentials. Limit who can trigger workflows and restrict cache write access. GitHub’s July 2026 update describes safer checkout defaults and controls on workflow triggers and caches. | Workflow controls do not validate every dependency or protect a maintainer’s account outside CI. |
| Detection and response | Monitor security advisories and lockfile changes; use package and malware alerts available in the tools you use. Investigate the affected version and execution context, then rotate credentials exposed to a compromised install and inspect dependent build systems. | Detection can be retrospective, and an alert does not by itself establish which systems executed a payload. Response should follow the specific advisory rather than assume a standard behavior. |
npm says it scans packages for known malicious content, runs them to identify behavioral patterns and removes reported malicious content. That is one layer of ecosystem defense, not a guarantee that every malicious version will be caught before installation. GitHub documents malware alerts for npm packages and advises investigating connected areas such as credential compromise, code injection and exfiltration.
What to do if a package version may be compromised
- Confirm the exact package and version. Compare your lockfile and installed dependency tree with the relevant advisory. Establish whether the affected version was present and whether its install script, browser bundle or other payload could have executed in your environment.
- Contain the affected dependency. Follow the advisory’s package-specific instructions to remove or replace the compromised version. Where relevant, clear local installations and caches, rebuild affected artifacts and remove compromised copies from private registries or mirrors.
- Assess credential exposure. Determine what secrets were accessible to the install process or build workflow. Rotate potentially exposed tokens and keys, including developer and cloud credentials, and review their use for suspicious activity.
- Check downstream systems. Inspect CI jobs, build artifacts, deployment environments and projects that consume the affected package. Preserve relevant logs and escalate through your organization’s incident-response process if credentials or production systems may have been exposed.
How to assess package-security tools
There is no supported basis here for ranking vendors. To compare a scanner, dependency-monitoring service or software-composition-analysis tool, evaluate the stage it covers, whether it prevents installation or alerts after detection, which ecosystems and registries it supports, the evidence and remediation detail in its alerts, and how it fits developer workflows. Check explicitly how it handles private registries and package mirrors, since an advisory or package finding may need to be applied there too.
Sources and scope
This account draws on npm’s “Threats and Mitigations” documentation; GitHub’s “Our plan for a more secure npm supply chain” and July 28, 2026 article “Disrupting supply chain attacks on npm and GitHub Actions”; CISA’s September 23, 2025 alert “Widespread Supply Chain Compromise Impacting npm Ecosystem”; Google Cloud/GTIG’s “Mitigation Guidance for Supply Chain Compromise”; the GitHub Advisory Database entry for [email protected]; and GitHub Docs’ “Common security incident investigation areas.” Reported attack counts, download totals and response scope measure different things. The cited sources do not provide one complete census of npm attacks, confirmed infection counts for every incident or comparative effectiveness data for vendors.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
