Enabling 2FA, trusted publishing with OIDC, and provenance attestations for your own npm packages raises the bar for anyone trying to hijack your identity in the ecosystem. In response, teams should anchor their workflows around strict, frozen lockfiles, enforce this behavior in CI, and guard those lockfiles with tools that validate the origin of your packages. The Shai‑Hulud campaigns exploited the fact that a single unnoticed version bump or lockfile modification could bring a malicious tarball into thousands of projects. Those controls must extend beyond npm itself to pnpm, Bun, and other modern package managers, so that your defaults are consistent across all tooling in the workspace. Npm verifies the OIDC token from your CI and only allows publishing from your approved workflows. Incidents like eslint-scope showed that once an attacker obtains credentials, they can publish backdoored versions to millions of users.
- Those controls must extend beyond npm itself to pnpm, Bun, and other modern package managers, so that your defaults are consistent across all tooling in the workspace.
- Supply chain attacks often targets credentials in the system.
- Bun disables postinstall scripts by default and maintains an internal allow‑list.
- Even if .env files are not committed to version control, they remain vulnerable targets during supply chain attacks where malicious code can read process environment variables or scan the filesystem to locate known configuration files containing secrets.
- Long-lived npm tokens can be compromised, accidentally exposed in logs, or provide persistent unauthorized access if stolen, posing significant security risks to your packages.
A single compromised package can cascade through entire ecosystems within hours. They sit in dependency trees used by millions of applications. The most vulnerable npm packages in 2026 include lodash, cross-spawn, gun.js, and widely used testing utilities carrying unpatched transitive dependencies. Over 99% of all open source malware now targets npm (Sonatype, 2026), making it the most heavily attacked open source ecosystem.
The same report identifies 454,648 new malicious packages discovered in 2025 alone. Awesomeawesome-listbest-practicesnodejsnpmsecurityshai-huludshai-hulud-attackshai-hulud-detectorsupply-chain-securityvulnerabilities Yet, some of the packages used in a project may receive security fixes that need to be rushed (and shouldn’t wait the time threshold https://www.cybertechnologies.com/career/ such as 7 days or more until a new version for the package is installed).
npm security tools: scanners, registries, and what each actually catches
Attackers monitor these hallucinations and publish malicious packages with those exact names, knowing developers may blindly trust and install AI-suggested packages. One of the main targets for typosquatting attacks are user credentials, since any package has access to environment variables via the global variable process.env. To verify which tokens are created for your user or to revoke tokens in cases of emergency, https://vortexsuccess.com/how-agentic-ai-reshapes-business-models.html you can use npm token list or npm token revoke respectively. Tokens make it easy to perform npm registry-related actions during CI and automated procedures, such as accessing private modules on the registry or publishing new versions from a build step.
These configurations prevent package managers from installing any package version that was published less than the specified time period ago. Configure npm, pnpm, Bun, or Yarn to delay package installations by setting a minimum release age in your package manager’s configuration file. The fetched repository can ship its own .npmrc that re-enables lifecycle scripts — silently undoing –ignore-scripts — and the code is never scanned by registry-side malware checks. Pnpm allows an “escape hatch” to re-enable postinstall scripts or set an explicit allow-list of packages that are allowed to run postinstall scripts. A curated and practical list of security best practice for using npm packages. Security gates at installation time, automated PRs that avoid very new releases, and tooling that understands the difference between a minor bug fix and an untrusted, never-before-seen package version are essential pieces of that picture.
- As of pnpm 10.26+, allowBuilds is the preferred replacement for both onlyBuiltDependencies and ignoredBuiltDependencies (the earlier settings are deprecated).
- The 2025 Gartner supply chain prediction (which we revisited in detail recently) was that 45% of organisations globally would experience supply chain attacks by 2025.
- The vendor pitch says one tool covers the whole problem; the reality is that each category handles one layer of the trust chain, and the defence has to be layered, automated, and inline.
- In September 2025, the original Shai-Hulud campaign used tampered versions of packages like ngx-bootstrap, ng2-file-upload, and @ctrl/tinycolor to deliver a worm-like payload through npm lifecycle scripts.
- This helps later root-cause analysis, credential-impact review, and any coordinated disclosure or insurance reporting.
- Pnpm does not have a direct equivalent to npm’s allow-git setting that blocks all git dependencies outright.
SBOM Analysis
For bun, the top 500 npm packages with lifecycle scripts are allowed by default. For example, the “Shai-Hulud” worms3 edit the package.json file to add a postinstall script that would then steal credentials. Pnpm also allows Git Branch Lockfiles where it creates a new lockfile based on branch name, and automatically merge it back into the main lockfile later. Modern package managers have built-in conflict resolutions1617, just checkout main and re-run install.
- Self-replicating malware is now established tradecraft.
- They do not detect supply chain attacks themselves but are essential for the explicit-trust workflow because they make it sustainable to pin versions strictly while keeping pace with legitimate updates.
- The payload was credential theft from .npmrc, .aws/credentials, GitHub tokens, and other authentication artifacts on the compromised developer machine.
- Enabling 2FA, trusted publishing with OIDC, and provenance attestations for your own npm packages raises the bar for anyone trying to hijack your identity in the ecosystem.