"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
summary
Detailed case studies show attackers using npmjs.help spoofing, infostealer malware to harvest CI/CD access tokens and TruffleHog to find secrets, then pushing malicious packages with postinstall scripts and GitHub Actions backdoors that steal crypto or mine coins. A September 2025 compromise of one maintainer reaches 2.6 billion weekly downloads across 18 packages and the self‑propagating Shai‑Hulud worm infects 27,000+ repositories. Recommended controls include SCA with behavioral detection, strict version pinning and lifecycle hook blocking, ephemeral tokens and private registries, SBOM integration and rapid incident playbooks.
AI-written summary · about
chapters (9)
- 0:00npm and its ecosystem
- 6:24npm growth and scale
- 7:33Why npm is a battleground
- 10:23Past npm supply-chain attacks
- 15:49eslint-scope attack scope
- 19:41Defensive strategies for npm
- 27:14npm security improvements
- 28:37Key takeaways
- 29:45Q&A
related talks
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
41mMalicious Modules on npm - a series of unfortunate events
53mLessons From NPM's Dark Side: Preventing the Next Shai-Hulud
25mWhen the supply chain hits a sour note
23mProtecting Your npm Dependencies
29mAll your packages are belong to us - Protecting your npm dependencies
31mWhat's Going on Inside the Node_Modules Folder
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack