Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud
summary
NPM advisories spike 20x in 2025 with account takeover events up 12x; attackers compromise popular packages (eslint-config-prettier: 38.1M weekly downloads; is: 2.8M) and exploit lifecycle behavior like install scripts run by default to drop DLLs, exfiltrate tokens and secrets. NX compromises touch 370 companies then 6,700 more and exfiltrate ~20,000 files; Shai‑Hulud hijacks 187 packages, converts 528 repos public and exposes credentials across ~26,000 repos. Effective mitigations: hardware keys, session tokens, lockfiles, disable lifecycle scripts, trusted publishing adoption remains low (~13%).
AI-written summary · about
chapters (22)
- 0:00Introduction
- 3:58Malware vs accidental vulns
- 8:59Why NPM is malware target
- 12:322025 NPM malware overview
- 13:14eslint-config-prettier compromise
- 15:43Package account takeover
- 17:52NX attack via GitHub Actions
- 20:36Quicks cryptocurrency theft
- 22:23Shai-Hulud worm attack
- 25:56Team PCP and Axios attacks
- 28:22Preventing maintainer ATOs
- 31:53Trusted publishing adoption
- 33:38Safe dependency consumption
- 35:26Developer malware prevention
- 37:56Product security hardening
- 40:20Cloud credential defense
- 41:24Incident response for malware
- 43:32Q&A
- 44:17Dependency gating approaches
- 47:06Upgrade speed vs malware risk
- 51:01Trusted publishing barriers
- 53:06Closing
related talks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
25mWhen the supply chain hits a sour note
47mBlack Clouds and Silver Linings in Node.js Security
21mSupply Chain Attacks on Open Source: What's Happening, What...
41mMalicious Modules on npm - a series of unfortunate events
35mSupply Chain Attacks: Focused on NPM attacks
23mProtecting Your npm Dependencies