"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?

"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?

Speakers: Harish Shankar, Schneider Electric

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=k7O72mxd6-U

Overview

In his FIRSTCON talk, "Malice in the Modules," Harish Shankar from Schneider Electric dissects the escalating threat landscape surrounding NPM (Node Package Manager) packages. The presentation meticulously outlines the incredible utility and pervasive adoption of NPM within the developer ecosystem, juxtaposing these benefits with the inherent vulnerabilities and systemic weaknesses that have transformed it into a prime target for sophisticated supply chain attacks. Shankar emphasizes that NPM, while indispensable for modern software development, has become a critical battleground where attackers exploit trust, dependency chains, and authentication gaps to compromise applications and infrastructure at scale.

The talk serves as a stark warning and a comprehensive guide for organizations and developers navigating the treacherous waters of open-source dependencies. Shankar highlights historical incidents, from phishing and typo squatting to advanced worm-like attacks, demonstrating the real-world impact of these compromises. Crucially, he transitions from problem identification to actionable solutions, proposing a multi-layered defensive strategy encompassing people, processes, and technology. This includes robust authentication, continuous monitoring, software bill of materials (SBOM) integration, developer training, and rapid incident response, underscoring the collective responsibility required to secure the software supply chain.

Why this talk matters is underscored by the sheer scale of NPM usage—millions of packages and billions of downloads annually—making any widespread compromise a potentially catastrophic event for global software infrastructure. As development cycles accelerate and reliance on external packages grows, understanding and mitigating these risks is no longer optional but a fundamental requirement for maintaining software integrity and operational security. Shankar's insights are particularly timely given the continuous evolution of supply chain threats, including the emerging role of AI in both perpetrating and defending against such attacks.

Background

▶ Watch: What is npm and its core benefits (0:45)

NPM, the Node Package Manager, stands as the de facto package repository for the Node.js ecosystem, enabling developers to effortlessly install, manage, and share JavaScript code. Its widespread adoption stems from several compelling benefits that streamline the software development process. Chief among these is reusability, allowing developers to incorporate pre-written, tested code modules for common functionalities (e.g., date handling) rather than writing everything from scratch. This fosters modular design, where specific functionalities can be extracted and integrated without needing to include an entire package, significantly reducing development time and promoting consistency.

A core strength of NPM lies in its dependency management. Through files like package.json and package-lock.json, developers can define direct and transitive dependencies—where package A depends on B, which depends on C, and so forth. This system automates the installation of all necessary components and ensures version stability, allowing developers to specify exact versions, minor releases, or patch updates, thereby maintaining predictable environments. Furthermore, NPM supports scripting and lifecycle hooks, enabling automation by defining commands that execute at specific stages (e.g., pre-install, post-install, pre-build). This rich feature set, combined with a vast and collaborative developer ecosystem, has cemented NPM's role as an indispensable tool.

The scale of NPM's adoption is staggering. In 2020, there were approximately 182 million NPM package downloads, a figure that has quadrupled within five years. As of September 2022, the repository hosted an estimated 2.1 million packages, a number that has since grown to over 3 to 5 million unique packages. This immense scale, while beneficial for innovation, also presents an unparalleled attack surface, making NPM a prime target for malicious actors.

Several factors contribute to NPM becoming a "supply-chain battleground":

1. Weak MFA and Access Tokens: Traditional Multi-Factor Authentication (MFA) with Time-based One-Time Passwords (TOTP) is susceptible to phishing. More critically, access tokens, used for automation in CI/CD pipelines or for publishing packages, bypass MFA entirely. If these tokens are compromised, attackers gain unfettered access to developer accounts and publishing rights.
2. Developer Trust: The NPM ecosystem thrives on trust. Developers often download packages based on reputation, download rates, and perceived utility. Once a package gains trust, it becomes a high-value target for compromise, as its malicious version can quickly propagate.
3. Transitive Dependencies: The deep nesting of dependencies (A depends on B, B on C, C on D) means that a compromise of a deeply embedded package (like D) can automatically compromise all upstream packages (A, B, C) that rely on it. This significantly increases the blast radius of an attack, potentially impacting hundreds, thousands, or even millions of projects from a single point of entry. These systemic vulnerabilities, coupled with NPM's ubiquity, create a fertile ground for sophisticated supply chain attacks.

Key Findings

▶ Watch: Major incident: The sophisticated Shahalud Worm attack (15:00)

Harish Shankar's presentation reveals several critical findings regarding the security posture of the NPM ecosystem and the nature of attacks targeting it:

• NPM's Inevitability and High-Value Target Status: NPM is an indispensable part of modern software development, but its widespread adoption and deep integration into software projects make it an extremely attractive and high-value target for attackers. This status is not diminishing; attacks are continuous and evolving, with new incidents emerging frequently.
• Exploitation of Core NPM Features: Attackers are not merely exploiting vulnerabilities but are leveraging the very functionalities designed to enhance developer productivity—such as dependency management, versioning, and lifecycle scripts—for malicious ends. The automation capabilities (e.g., post-install scripts) become vectors for initial compromise and persistence.
• Multi-Vector Attack Landscape: The talk illustrates a diverse range of attack methodologies, including social engineering (phishing for MFA tokens), deceptive package naming (typo squatting), and highly sophisticated, self-propagating threats like the "Shahalud worm." These attacks aim for credential theft (especially access tokens), malicious code injection (browser interceptors, cryptocurrency theft), and widespread propagation through compromised CI/CD pipelines.
• Amplified Blast Radius via Transitive Dependencies: The hierarchical nature of NPM dependencies means that a single compromised low-level package can cascade its malicious impact across numerous dependent projects, dramatically increasing the scale and severity of supply chain breaches.
• Necessity of a Layered Defense Model: A single security control is insufficient. Effective defense requires a comprehensive, layered approach encompassing clear visibility into dependencies, robust policies, continuous monitoring, and a rapid, well-defined incident response mechanism. This model must integrate people, processes, and technology.
• Proactive Measures and Continuous Monitoring are Paramount: Given the dynamic nature of threats and the potential for legitimate packages to become compromised over time, static security checks are inadequate. Continuous monitoring of SBOMs, dependency tables, and external indicators of compromise (IOCs) is essential for early detection and proactive intervention.
• Developer Education and CI/CD Protection are Critical: Developers are often the initial point of compromise, highlighting the need for extensive training on supply chain risks. Simultaneously, securing the CI/CD pipeline—a common target for leveraging stolen access tokens—is vital to prevent malicious package publication and propagation.
• NPM Platform Improvements are Positive but Not a Panacea: Recent announcements from NPM to disable pre/post-install scripts by default, improve dependency resolution, and expose remote URLs are significant steps towards enhancing security by design. However, these measures do not eliminate the need for organizations and developers to adopt their own rigorous security practices.

Technical Deep Dive

▶ Watch: Essential layered defense strategies for npm security (18:50)

The core of the "Malice in the Modules" talk delves into the technical mechanisms by which attackers exploit NPM's features and the broader Node.js ecosystem. Shankar illustrates how the very benefits designed for developer efficiency become vulnerabilities when misused.

One significant area of exploitation is authentication weaknesses. While NPM offers MFA, traditional TOTP (Time-based One-Time Password) implementations are vulnerable to phishing. Attackers craft convincing phishing emails, often impersonating NPM support, to trick developers into revealing their MFA tokens. Once compromised, an attacker gains control of the developer's account. More critically, access tokens are frequently used for automated tasks, such as publishing packages or integrating with CI/CD (Continuous Integration/Continuous Delivery) pipelines. These tokens inherently bypass MFA, meaning their theft grants direct, unauthenticated access to critical publishing and deployment infrastructure. This was a key vector in several incidents, where stolen access tokens allowed attackers to inject malicious code into legitimate packages or publish new, harmful ones.

The talk highlights how developer trust and the sheer volume of packages are weaponized. Attackers exploit developers' reliance on popular, well-maintained packages. They might target the maintainers of such packages or create deceptive packages that typo squat on popular names. For instance, a legitimate package like add-typescript could be mimicked by a malicious add_typescript or at-node (replacing a slash with a dash). When a developer inadvertently downloads the typo-squatted package, the malicious code is introduced into their environment.

Crucially, the transitive dependency model amplifies the blast radius of attacks. If Package A depends on Package B, which depends on Package C, and Package C is compromised, then A and B are also implicitly compromised. Attackers target deeply nested dependencies because a single successful compromise can affect a vast number of downstream projects. This makes detection difficult, as the malicious package might not be a direct dependency but rather one buried several layers deep.

NPM's scripting capabilities and lifecycle hooks are another critical attack vector. Developers can define scripts in package.json that execute at various stages of the package lifecycle, such as pre-install or post-install. Attackers embed malicious JavaScript payloads within these scripts. In the typo squatting example, a post-install script was used to run a deceptive batch file, which was actually a malicious executable. This executable then established persistence by placing itself in the system's startup folder and initiated communication with external C2 (Command and Control) servers, such as Pastebin URLs, to harvest credentials and perform other malicious actions.

Shankar describes three specific incidents to illustrate these points:

1. Phishing Attack: An attacker sent a phishing email disguised as an NPM support alert, prompting a developer to update their MFA token. Upon submission, the developer's account was compromised. The attacker then published a malicious version of an existing package. This package contained a JavaScript payload designed to act as a browser interceptor, modifying HTTP requests and responses. Specifically, it targeted cryptocurrency transactions, altering the recipient wallet address to the attacker's wallet during the transaction signing process, effectively stealing funds from unsuspecting users. The downstream impact was significant as other packages using this compromised dependency also became vulnerable.

1. Typo Squatting Attack: As mentioned, attackers registered packages with names strikingly similar to popular, legitimate ones. When a developer searched for and installed one of these malicious typo-squatted packages, its post-install script executed. This script launched a malicious executable (disguised as a batch file) that ensured persistence (e.g., via the startup folder) and established communication with external URLs (like Pastebin) to exfiltrate credentials and perform other nefarious activities.

1. Shahalud Worm: This was a highly sophisticated, worm-like supply chain attack. The initial compromise typically involved social engineering targeting a developer, leading to the installation of a malicious package. Upon execution, the payload stole access tokens from the developer's machine. These stolen tokens were then used to access the organization's CI/CD pipeline and repositories, allowing the attacker to publish further malicious packages. This created a self-propagating mechanism: new developers installing these tainted packages would, in turn, have their credentials stolen, perpetuating the worm's spread. The Shahalud worm reportedly impacted thousands, potentially millions, of projects, compromised CI/CD pipelines, and consumed significant system resources, highlighting the rapid propagation and severe impact of such advanced attacks.

The common thread across these incidents is the exploitation of NPM's fundamental design principles—ease of use, dependency chaining, and automation—to achieve widespread compromise, credential theft, and persistent access.

Demo / Proof of Concept

▶ Watch: Q&A: The impact of AI on npm supply chain attacks (29:30)

Harish Shankar's talk focuses on providing a comprehensive overview of NPM supply chain threats and defensive strategies, drawing upon real-world incidents and observed attack patterns. While the presentation thoroughly details the technical mechanisms of various attacks, including phishing, typo squatting, and the Shahalud worm, it does not include a live demonstration or a proof of concept conducted by the speaker. Instead, the technical deep dive is supported by descriptions of these past, publicly known incidents to illustrate the tactics, techniques, and procedures employed by attackers.

Defensive Implications

▶ Watch: Q&A: Is npm inherently vulnerable or just popular? (36:00)

Defending against NPM supply chain attacks requires a proactive, multi-layered approach that addresses people, processes, and technology. Harish Shankar outlines a robust defense model:

1. Clear Visibility and Due Diligence: Organizations must have clear visibility into all NPM packages used across their projects, including all transitive dependencies. This means understanding not just what direct packages are installed, but every component they rely on. Due diligence on packages is paramount; "identity is not equal to provenance," meaning a package's name doesn't guarantee its trustworthiness.
2. Continuous Monitoring: Packages can be compromised at any time. A package deemed safe today might become malicious tomorrow. Therefore, continuous monitoring of all installed packages and their dependencies is essential to detect new vulnerabilities or malicious alterations. This monitoring must be integrated with vulnerability intelligence tools.
3. Rapid Response: The rapid propagation potential of supply chain attacks necessitates a rapid response capability. Organizations must be able to detect, contain, and remediate compromises swiftly to minimize blast radius and impact.
4. Minimize Dependencies: While NPM's reusability is beneficial, excessive or unnecessary dependencies increase the attack surface. Developers should strive to minimize dependencies wherever possible, both as maintainers and users of packages.
5. Secure Dependency Management:

• Scan Dependency Table: Regularly scan the dependency table for known vulnerabilities or suspicious packages.
• Use package-lock.json: This file locks down exact versions of dependencies, preventing automatic, potentially malicious, updates that could occur if only package.json is used with broad version ranges.
• Exact Versioning: Pinning specific package versions (e.g., 1.2.3 instead of ^1.2.x) provides greater control and predictability, making it easier to identify and contain issues.

1. Protect CI/CD Pipelines: These pipelines are critical targets. Implementing strong controls and security measures within CI/CD environments is non-negotiable. While developers might express concerns about increased friction, protecting these pipelines is essential to prevent malicious package publication and propagation.
2. Strong Authentication: Enforce robust authentication mechanisms, moving beyond traditional TOTP-based MFA to hardware-based MFAs where feasible. NPM's recent enforcement of MFA is a positive step, but organizations should aim for the strongest possible authentication.
3. Software Bill of Materials (SBOM): Organizations must generate and maintain a Software Bill of Materials (SBOM) for all products. An SBOM provides a comprehensive list of all software components. Crucially, SBOMs need to be continuously monitored. Schneider Electric, for example, integrates SBOMs with vulnerability intelligence tools to identify new vulnerabilities, public/private exploits, malicious packages, and their origination. This enables proactive detection and rapid response based on the severity and exploitability of discovered issues.
4. Protect Developer Workstations: Developer machines are often the initial point of compromise. Strong EDR (Endpoint Detection and Response) and endpoint controls are vital to detect and block malicious activity, especially during package downloads and installations.
5. Sandbox Build Environments: Utilizing sandbox build environments allows developers to test packages and builds in isolation, detecting any malicious behavior before it can impact production systems.
6. Developer Training and Awareness: Instead of discouraging NPM usage, organizations must train developers on supply chain risks. Education should cover the consequences of downloading malicious packages, common attack vectors, and secure development practices. Developers need to understand that supply chain attacks are a reality, not a fictional threat.
7. Incident Response Playbook: Develop a comprehensive incident response playbook tailored for supply chain compromises. This playbook should differentiate response mechanisms based on the scope of compromise (e.g., developer environment vs. shipped products) to ensure rapid containment and effective remediation.

Recent Announcements from NPM (Positive Developments):

NPM has begun adopting a "secure by design" principle with upcoming changes:

• Disabled Scripts by Default: pre-install and post-install scripts will be disabled by default. Developers will need to explicitly enable them, significantly reducing a common attack vector.
• Enhanced Dependency Resolution: NPM will provide more detailed information about all direct and transitive dependencies, improving visibility.
• Remote URL Resolution: NPM will resolve and expose all remote URLs used within packages (both direct and transitive dependencies). This is a critical feature, allowing CTI (Cyber Threat Intelligence) teams to proactively check these URLs against known IOCs, enabling preventative actions rather than just reactive responses.

These platform-level improvements, combined with robust organizational defenses, represent the path forward for securing the NPM supply chain.

Key Takeaways

• NPM is indispensable but a high-value target: The Node Package Manager is an integral part of modern development, making it an inevitable and continuously targeted component of the software supply chain. Organizations must accept its presence and focus on securing its usage rather than attempting to avoid it.
• Attacks are sophisticated and frequent: From phishing and typo squatting to advanced worm-like compromises like the Shahalud worm, attackers exploit NPM's core features (dependencies, scripting, automation) to achieve credential theft, CI/CD pipeline compromise, and widespread propagation. New incidents, including AI-based compromises, are emerging regularly.
• Layered defense is non-negotiable: A robust security posture requires a comprehensive, multi-layered approach encompassing people (developer training, awareness), processes (policies, SBOM, incident response playbooks), and technology (strong MFA, EDR, continuous monitoring, sandbox environments).
• Proactive visibility and rapid response are paramount: Continuous monitoring of all NPM packages and their transitive dependencies, coupled with the ability to swiftly detect, contain, and remediate incidents, is crucial. Integrating SBOMs with vulnerability intelligence tools is a powerful proactive measure.
• NPM's platform improvements are a positive step: Recent changes from NPM, such as disabling pre/post-install scripts by default and resolving remote URLs, significantly enhance security by design. However, these improvements do not absolve organizations of their responsibility to implement strong internal security practices.
• Collective effort is essential: Securing the NPM ecosystem is a collective responsibility. Developers, organizations, and the broader security community must work together to share intelligence, implement best practices, and continuously adapt defenses against evolving supply chain threats.

About the Speaker(s)

Harish Shankar is a security expert from Schneider Electric. Based on his presentation, he possesses deep expertise in software supply chain security, particularly concerning open-source package managers like NPM. His insights reflect a strong understanding of both the technical intricacies of these ecosystems and the strategic implications of supply chain compromises for enterprises. Harish's role likely involves designing and implementing security measures to protect Schneider Electric's software development lifecycle and products from emerging threats.