Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud

Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud

Speakers: Jenn Gile (OpenSourceMalware)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=qQ_n9_nbEE0

Overview

In this compelling talk at VulnCon, Jenn Gile, co-founder of opensourcemalware.com, illuminated the escalating threat of intentionally malicious packages within the Node Package Manager (NPM) ecosystem. Titled "Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud," the presentation served as a stark reminder that while traditional vulnerabilities remain a concern, a new breed of threat specifically engineered to do harm is rapidly gaining traction. Gile emphasized the critical distinction between accidental flaws and deliberate malicious intent, arguing that current vulnerability management paradigms often leave organizations susceptible to sophisticated supply chain attacks.

The talk underscored the urgency of addressing this emerging threat, particularly for developers and their build systems, which are increasingly becoming "patient zero" for these attacks. Gile provided a deep dive into several high-profile NPM malware campaigns from 2025, including the infamous Shai-Hulud, alongside more recent incidents involving Team PCP and Axios. Her analysis highlighted common attack vectors, the ingenuity of threat actors, and the often-overlooked vulnerabilities in developer workflows and open-source consumption practices.

This article synthesizes Gile's insights, offering a comprehensive look at why NPM is a prime target, the mechanics of recent attacks, and actionable strategies for both maintainers and consumers of open-source software. It aims to equip security professionals and developers with the knowledge needed to fortify their defenses against an evolving threat landscape where trust, convenience, and automation can be weaponized against the software supply chain.

Background

▶ Watch: Differentiating accidental vulnerabilities from intentional malware (2:40)

The core premise of this talk revolves around a crucial distinction: the difference between accidental vulnerabilities and intentionally malicious packages. Accidental vulnerabilities, familiar to anyone in security, are flaws introduced by developers, often through oversight or error. They are potential exploits, typically application-focused, and are managed through mechanisms like CVEs (Common Vulnerabilities and Exposures). These vulnerabilities, once discovered, exist indefinitely within older package versions.

In contrast, intentionally malicious packages are explicitly engineered to cause harm. There is no hypothetical exploitation; the intent is direct. Historically, malware targeted end-users via phishing or clickbait. However, malicious open-source packages primarily target developers and their build systems. This shift is significant because developers possess privileged access to credentials, intellectual property, and internal systems, making them high-value targets for lateral movement and data exfiltration. Unlike accidental vulnerabilities, malicious packages often have a very short lifespan on public registries, frequently removed within hours or days once reported, though some can persist for years. Gile argued against assigning CVEs to malware, emphasizing its distinct nature.

The challenge arises because security programs, traditionally built around managing accidental vulnerabilities, often employ practices that inadvertently increase susceptibility to malware. A prime example is the common advice to "upgrade to the latest version" to patch CVEs. For malicious packages, however, upgrading to the latest version can be precisely how malware is introduced, as threat actors often publish malicious updates to legitimate packages.

NPM stands out as a particularly attractive target for threat actors for several reasons, largely stemming from design choices that prioritize ease of use:

1. Install Scripts Run by Default: NPM's lifecycle scripts, such as postinstall, execute automatically during package installation unless explicitly deactivated. This means a malicious script can trigger and compromise a system the moment a package is downloaded, regardless of whether the package's functionality is ever used in the application.
2. Lack of Mandatory Provenance: NPM does not mandate provenance (the verifiable history of a package's origin and changes), nor are there widely adopted, easy-to-use mechanisms for consumers to validate it. This absence of strong integrity checks makes it easier for threat actors to inject malicious code or take over existing packages without detection.
3. Long-Lived Access Tokens: For many years, NPM utilized long-lived access tokens for publishing. The extended lifespan of these tokens significantly increased the window of opportunity for attackers to compromise and misuse them, either through theft or social engineering.
4. JavaScript's Transitive Dependencies: The JavaScript ecosystem, where NPM is dominant, is notorious for its deep and wide dependency trees. Installing a single package can pull in hundreds or thousands of transitive dependencies. This provides threat actors with ample opportunity to compromise a seemingly innocuous, deep-nested dependency that an end-user might not even be aware of, greatly expanding the potential blast radius of an attack.

While other ecosystems like PyPI and VS Code extensions are also seeing increased targeting, NPM's combination of default script execution, lax provenance, historical token practices, and extensive dependency chains creates a "perfect storm" for supply chain attacks.

Key Findings

▶ Watch: Deep dive into the Shai-Hulud worm attack (21:30)

Gile's research, conducted with the Endor Labs team and leveraging data from OpenSSF's malicious package stats on OSV, revealed a dramatic surge in NPM malware activity in 2025. The data showed a significant upward trend, particularly in the latter half of the year.

Specifically, the key findings highlighted were:

• 20x Increase in NPM Malware Advisories: NPM malware advisories saw an astounding 20-fold increase in the past year. Much of this surge was attributed to a single, large-scale campaign known as Indonesian Foods. This indicates a substantial overall increase in the volume of malicious packages being identified and reported.
• 12x Increase in Account Takeovers (ATOs): A more insidious and arguably more dangerous trend was the 12-fold increase in account takeovers (ATOs). An ATO occurs when a threat actor gains unauthorized access to a legitimate, widely used open-source package, locks out the original maintainer, and then publishes malicious versions under the guise of the trusted project.
• Trust as the Primary Vector for ATOs: While ATOs represent a smaller numerical category of malware compared to "born bad" packages (those created maliciously from scratch), their impact is disproportionately higher. This is because ATOs exploit the inherent trust users and developers place in established packages with millions or even billions of downloads. By compromising such packages, threat actors leverage pre-existing trust, making their malicious code far more likely to be adopted and executed within critical systems. This "trust vector" makes ATOs a particularly potent and concerning threat.

These statistics underscore a rapidly evolving threat landscape where sophisticated social engineering and supply chain vulnerabilities are increasingly leveraged to compromise widely adopted open-source components, posing a significant risk to organizations relying on these packages.

Technical Deep Dive

▶ Watch: Three key security measures for NPM maintainers (28:00)

The talk provided a detailed examination of several pivotal NPM malware campaigns from 2025 and early 2026, illustrating the evolution of attack sophistication and impact.

1. eslint-config-prettier (July 18, 2025)

This attack targeted a package with 38.1 million weekly downloads, demonstrating a massive potential blast radius. The maintainer fell victim to a typosquatting attack via a sophisticated phishing email. The email, formatted professionally with the NPM logo and seemingly legitimate language, prompted the maintainer to "verify their email address" by clicking a link to NPM.js (instead of npmjs.com). Upon clicking, the maintainer's NPM token was scraped.

With the stolen token, attackers uploaded four compromised packages containing a malicious install.js script. This script dropped and executed a malicious DLL payload during npm install, achieving Remote Code Execution (RCE) on Windows developer machines or CI hosts. While narrowly focused on Windows, this incident highlighted the effectiveness of social engineering combined with NPM's default script execution.

2. is package (July 19, 2025)

Just one day after the eslint-config-prettier attack, the is package, with 2.8 million weekly downloads, was compromised. This attack showcased a more creative social engineering tactic. The maintainer received a spoofed NPM support email claiming that one of their co-maintainers had been "accidentally revoked" and requested the maintainer re-add them. Believing it was a legitimate NPM error, the maintainer complied, inadvertently granting access to the attacker.

Two malicious versions were published, again using an install.js script to drop a DLL payload. This RCE was more sophisticated, operating across various machine types. It was designed to exfiltrate NPM tokens, scan for crypto wallets, and steal cloud credentials. Thousands of developer environments and CI/CD pipelines were exposed, underscoring the shift towards financial motivations, with North Korean threat actors noted for similar crypto theft campaigns.

3. NX (August 2025)

The NX compromise represented a departure from social engineering, leveraging a vulnerability in a GitHub Action. Attackers exploited an undiscovered flaw to steal the NPM maintainer's publishing token. This incident illustrated a crossover between traditional vulnerabilities and supply chain attacks.

Using the stolen token, eight packages were published with a malicious postinstall script triggering telemetry.js. This malware was particularly innovative: it actively searched the local environment for locally installed AI tools (Claude, Gemini, Amazon Q) and then overrode their configurations (e.g., force yellow, dangerously skip permissions, trust all tools). By tricking these AI agents into becoming "collaborators," the malware leveraged them to scrape the local environment for secrets and exfiltrate them.

Within 8 hours, 370 companies were affected, with their GitHub repositories (known by the "singularity" naming convention) flipped to public. Two days later, a second wave of attacks leveraged unrotated secrets from the initial compromise, flipping an additional 6,700 repos public and exfiltrating over 20,000 files. This highlighted a critical failure in post-compromise secret rotation.

4. quicks (October 2025)

Maintainer "quicks," responsible for packages with 2.6 billion weekly downloads (including popular ones like chalk and debug), was targeted by another "very smart social engineering email." This email, seemingly from NPM, demanded a 2FA update, threatening a temporary account lock. Under pressure and believing it was a legitimate security measure, the maintainer clicked the link, leading to compromise.

The attack affected 28 packages and deployed a cryptocurrency stealer. Despite the vast blast radius, only about $1,000 was stolen, leading to speculation about the true motives—perhaps a test run or a distraction.

5. Shai-Hulud (November 2025)

The Shai-Hulud campaign was arguably the most impactful. The original maintainer received a fake NPM support email, which enabled attackers to reset their 2FA and lock them out, gaining access to 187 packages.

The attackers embedded a malicious bundle.js within a color library, which then installed and weaponized TruffleHog, a popular secret scanner. This was a critical innovation: instead of writing their own secret-scanning logic, they repurposed a legitimate, widely used tool. The malware had a worm-like component: any system that downloaded a compromised Shai-Hulud package would automatically have its own packages hijacked and republished with the malware, spreading the infection exponentially.

This led to 528 repositories being made public and a massive exfiltration of secrets via a webhook service (which eventually exceeded usage quotas). Crucially, a second wave occurred in November, just before an NPM security improvement. This wave leveraged unrotated secrets from the first attack to compromise an additional 100+ maintainers and 492 packages. This time, the attack used Bun to download TruffleHog and scrape secrets, with a particularly nasty twist: if an authentication failure was detected, it would wipe the home directory. Ultimately, credentials from 26,000 repositories, including those of major companies like Postman and Zapier, were exposed. Research showed that valid credentials persisted up to 72 hours after disclosure due to insufficient secret rotation.

Bonus: Team PCP and Axios (March 2026)

More recent attacks in March 2026 demonstrated continued sophistication:

• Team PCP: Gained access to Trivy by finding a long-lived Personal Access Token (PAT). After weeks of dormancy, they poisoned Trivy, leading to the compromise of various security providers and Light LLM. Light LLM was praised for its transparent public communications regarding the incident.
• Axios: This was an "extremely sophisticated social engineering campaign." Threat actors spoofed a legitimate company, setting up a fake Slack instance with pre-populated messages to build rapport and trust with the maintainer. They invited him to a Teams call, where a pop-up prompted a "security update" for Teams. Clicking this link downloaded malware that scraped for secrets, ultimately compromising Axios. This attack was traced back to North Korean threat actors.

These incidents collectively paint a picture of an increasingly aggressive and sophisticated threat landscape, where attackers exploit human trust, automation, and even legitimate tools to achieve widespread compromise.

Demo / Proof of Concept

▶ Watch: Practical tips for safe open source consumption (34:00)

While Jenn Gile's talk did not feature a live technical demonstration in the traditional sense, the "Technical Deep Dive" section served as a detailed exposition of how these sophisticated attacks were conceptualized, executed, and propagated. Each campaign described—from the typosquatting of eslint-config-prettier to the worm-like spread of Shai-Hulud and the AI-agent manipulation in the NX breach—functioned as a proof of concept for the various attack vectors and malicious capabilities.

Gile meticulously explained the specific mechanisms employed:

• The use of malicious install scripts (install.js, postinstall) to automatically execute payloads upon package download.
• The deployment of DLLs for Remote Code Execution on target systems.
• The innovative manipulation of AI agents by overriding their configurations to aid in secret exfiltration.
• The weaponization of legitimate security tools like TruffleHog for unauthorized secret scanning.
• The implementation of worm-like propagation where compromised packages automatically republished themselves.
• The sophisticated social engineering tactics, including typosquatting, fake 2FA updates, and elaborate fake company setups with Slack and Teams interactions, demonstrating how human vulnerability is exploited.

Through these detailed case studies, the talk effectively "demonstrated" the practical application of these attack techniques in real-world scenarios, offering a clear understanding of the threat actor's methodology and the devastating impact on the software supply chain.

Defensive Implications

▶ Watch: Q&A: Why is trusted publishing adoption still low? (50:30)

Gile outlined a multi-faceted approach to defending against malicious open-source packages, emphasizing that it's a "team sport" requiring collaboration across different organizational functions: developers, product security, cloud security, and incident response/threat hunting.

For Open Source Maintainers (NPM Specific)

Maintainers are on the front lines and have critical responsibilities:

1. Hardware Keys (e.g., YubiKey): Available since 2015, hardware keys protect the human authentication path by refusing to sign if the browser's origin doesn't match the registered domain. This is a robust defense against token scraping via phishing. The maintainer of Axios, for instance, immediately planned to implement this. Despite their effectiveness, adoption rates are low across the board.
2. Trusted Publishing: Offered by GitHub since July 31st, 2025, this protects the machine path (CI/CD pipelines). It ensures that packages are only published through a specific GitHub Actions runner using an OIDC token, validating provenance. However, adoption rates are notably low: only 13% of previous ATO victims and 10.8% of Shai-Hulud victims were using trusted publishing when data was last pulled. Challenges include friction in adoption, perceived difficulty in setup, limited ecosystem support, and the need to explicitly block other publication methods in NPM's configuration.
3. Session-Based Authentication: Implemented in early December 2025 (after Shai-Hulud wave two), this change eliminated long-lived NPM tokens, limiting the exposure window. While initial tokens could still be up to 90 days, this significantly reduces the risk compared to indefinitely long tokens. Implementing all three of these measures provides robust protection for maintainers.

For Consumers of Open Source (Organizational Strategies)

Organizations consuming open source need to adjust their internal practices:

1. Developers: Focus on Safe Dependency Consumption

• Lock Files and Controlled Upgrades: Pinning dependency versions and being intentional about upgrades (rather than auto-upgrading to latest) helps avoid immediately pulling in malicious updates during an ATO. A "cool-down period" of 2-3 days before upgrading new packages is recommended, as most malicious versions are removed within this timeframe. This requires a robust exceptions policy for critical CVEs.
• Beware/Disable Lifecycle Scripts: Recognizing that postinstall and similar scripts automatically execute malware, developers should consider disabling them or exercising extreme caution. This introduces friction but prevents automatic compromise.

2. Product Security: Harden Pipelines, Enforce Guardrails

• Dependency Hygiene: Actively remove unused or underused dependencies to reduce the attack surface and accelerate incident response. For small, non-complex dependencies, consider "vibe coding" (writing your own version) if internal support is feasible.
• Scan for Malware: Integrate malware scanning early in the development lifecycle. Scanning in the IDE (Integrated Development Environment) via hooks, agents, or an MCP server is ideal, as it prevents developers from ever pulling down malicious packages. Scanning in CI/CD is also crucial but means the malware has already been downloaded.

3. Cloud Security: Blast Containment, Credential Defense

• Rapid Credential Rotation and Scoping: Implement processes to quickly rotate and scope cloud credentials (e.g., AWS keys) if a developer laptop is compromised. Ensure monitoring is in place to detect when such keys are stolen.
• Monitor for Anomalous Credential Use: Actively monitor for unusual access patterns, such as logins from unexpected time zones or locations, indicative of compromised credentials. The Shai-Hulud attack revealed that 13% of exfiltrated secrets were cloud keys, and many companies failed to rotate them for up to 72 hours post-disclosure.

4. Incident Response and Threat Hunters: Proactive & Prepared

• Open Source Software-Specific Threat Intelligence: Curate threat intelligence specifically for malicious open source. Resources like OSV and various vendors offer free intel. Understand that open-source malware often differs in language (JavaScript/Python vs. compiled) and hunting techniques.
• Supply Chain-Specific Incident Response Playbook: Develop and regularly test (e.g., through tabletops) an incident response playbook tailored to software supply chain attacks. Organizations caught unprepared by Shai-Hulud often faced severe disruption, with some having to block NPM usage for weeks.

By implementing these comprehensive strategies, organizations can significantly reduce their exposure to the persistent and evolving threat of malicious open-source packages.

Key Takeaways

• Malware is Distinct from Vulnerabilities: Intentionally malicious packages are engineered to do harm, targeting developers and CI/CD systems, unlike accidental vulnerabilities. Traditional vulnerability management can increase susceptibility to malware.
• NPM is a Prime Target: Default install scripts, lack of mandatory provenance, historical long-lived tokens, and JavaScript's deep transitive dependencies create a "perfect storm" for attackers.
• Account Takeovers (ATOs) are a Major Threat: ATOs, which exploit trust in legitimate packages, surged 12x in 2025. They leverage social engineering and stolen credentials to publish malicious updates to widely used packages.
• Sophistication is Rising: Recent campaigns like NX (AI agent manipulation) and Shai-Hulud (weaponized TruffleHog, worm-like spread, home directory wipe) demonstrate advanced and destructive tactics.
• Secret Hygiene is Critical: A recurring theme is the failure to rotate compromised secrets post-attack. Many organizations left valid credentials exposed for days, enabling secondary waves of attacks.
• Defense Requires a Team Sport Approach: Effective mitigation demands collaboration across developers (controlled upgrades, disabling lifecycle scripts), product security (dependency hygiene, early scanning), cloud security (credential rotation, monitoring), and incident response (supply chain-specific playbooks, threat intel).

About the Speaker(s)

Jenn Gile is the co-founder of opensourcemalware.com, a platform dedicated to providing threat intelligence for malicious open-source packages, domains, repositories, and related crypto activities. She is an advisor to Endor Labs and is deeply involved with BSides Seattle. Beyond her professional work in cybersecurity, Jenn is also an avid cyclist and serves on the board of a community cycling center in Tacoma. Her expertise lies in understanding and combating the evolving landscape of open-source supply chain attacks.