npm supply chain monitoring

Maintainer account hijacking

An attacker takes control of a package maintainer's npm account through phishing, credential stuffing, or session token theft. They publish a new version with malicious code under the legitimate package name. Because the package already has millions of downloads, the malicious version installs automatically when users run npm update.

Scope squatting

npm scopes (e.g. @company/package) are not tied to verified organizations. An attacker can register a scope that looks similar to a legitimate organization (e.g. @aws-sdk vs @aws-sdk-v3) and publish packages under it. Users who mistype the scope name or are tricked by a look-alike install the malicious package.

postinstall hook abuse

npm packages can define a postinstall script in package.json that executes arbitrary shell commands during npm install. A malicious postinstall script runs immediately after install, before the package is ever imported, and has access to the CI/CD environment, cloud credentials, and SSH keys present in the shell environment.

Dependency confusion

An attacker discovers an internal package name used in a target organization (through leaked package-lock.json files, job postings, or error logs) and publishes a public npm package with the same name at a higher version. npm resolves the public registry version over a private registry if both are configured.

Protestware and backdoors in transitive dependencies

Attackers contribute to lower-visibility transitive dependencies that are installed indirectly through popular packages. Because most developers do not audit transitive dependencies, a backdoored transitive dependency can persist undetected for longer than a direct compromise.