- The Mini Shai-Hulud worm compromised over 84 packages under @tanstack, using OIDC token theft and cache poisoning to self-replicate.
- A separate phishing attack on maintainer Qix led to 18 popular packages being backdoored with crypto-stealing code targeting Web3 wallets.
- Another campaign by Namastex Labs used stolen credentials to self-propagate across 16+ packages, targeting AI and backend tools, and even crossing into PyPI.
- Organizations must rotate credentials, audit dependencies, enforce strict CI/CD policies, and consider using tools like pnpm with built-in defenses to mitigate these threats.
The npm ecosystem has been hit by a series of sophisticated supply chain attacks over the past few months, compromising hundreds of packages and affecting millions of downloads. Security researchers from multiple firms have documented a wave of malware campaigns, including the Mini Shai-Hulud worm, a targeted phishing attack on a key maintainer, and a credential-stealing worm that self-replicates across package registries. These incidents highlight a troubling trend: attackers are increasingly exploiting the trust inherent in open-source package managers to distribute malicious code, steal credentials, and even hijack cryptocurrency transactions.
The combined impact of these attacks underscores the urgent need for developers and organizations to rethink their dependency management and security practices. From the TanStack compromise to the Qix phishing incident and the Namastex Labs worm, each campaign reveals new tactics and a growing sophistication that demands a proactive, multi-layered defense strategy.
The Mini Shai-Hulud Campaign
One of the most significant attacks involved the Mini Shai-Hulud worm, which first emerged in April 2026 and continued through June. On May 11, attackers compromised the GitHub Actions CI pipeline of TanStack, a popular React framework, and published 84 malicious package versions across 42 @tanstack/* packages in just six minutes. The worm used a novel technique: it exploited a pull_request_target workflow to poison the GitHub Actions cache, then extracted an OIDC token from the runner’s memory to publish packages with valid SLSA provenance. The malicious payload, router_init.js, was heavily obfuscated and designed to steal credentials from CI/CD environments, cloud providers, and developer workstations. It also planted persistence hooks in Claude Code and VS Code configuration directories. The worm then used stolen npm tokens to self-replicate, spreading to other packages maintained by the victim, including those from UiPath, Mistral AI, and OpenSearch. Unit 42 researchers linked this activity to the Shai-Hulud malware family, noting that the code was later publicly released on May 12, enabling copycat attacks.
Further waves of Mini Shai-Hulud targeted SAP’s CAP ecosystem on April 29, compromising four packages with a combined 570,000 weekly downloads. The malware used a preinstall hook to download the Bun runtime and execute a credential stealer that targeted GitHub tokens, npm tokens, cloud credentials, and even password managers. Exfiltration was routed through a dead-drop mechanism using GitHub commit search, making C2 infrastructure resilient. On June 1, a related attack compromised 32 packages under the @redhat-cloud-services namespace, using a compromised Red Hat employee GitHub account to bypass code review and publish trojanized packages with valid SLSA attestations. The payload, named Miasma, was a derivative of Mini Shai-Hulud and replaced legitimate index.js files with a 4.29 MB obfuscated version.
The Qix Phishing Attack
In September 2025, a highly targeted phishing campaign compromised Josh Junon (known as Qix), a prolific npm maintainer. The attacker sent a convincing email from a fake domain (support@npmjs.help) claiming his 2FA needed updating. Junon entered his credentials on a phishing site, giving attackers full control of his npm account. Within hours, 18 popular packages—including chalk, debug, ansi-regex, and supports-color—were updated with malicious code. These packages collectively have over 2.6 billion weekly downloads. The injected code acted as a browser-based interceptor, hooking into fetch, XMLHttpRequest, and wallet APIs (Ethereum and Solana) to replace cryptocurrency addresses in transactions. The malware was designed to silently redirect funds to attacker-controlled wallets, and it used heavy obfuscation to evade detection. Aikido Security detected the compromise and notified Junon, who began cleanup within two hours. The malicious versions were removed from npm, but the incident highlighted the vulnerability of single maintainer accounts. Later, other maintainers like duckdb_admin were also compromised in the same campaign.
The Namastex Labs Worm
Another active campaign, identified by Socket and StepSecurity, targeted packages published by Namastex Labs. At least 16 packages were confirmed compromised, including @automagik/genie, pgserve, and @fairwords/websocket. The malware stole authentication material—npm tokens, cloud credentials, CI/CD secrets, SSH keys, and even cryptocurrency wallet data from browsers. It then used any discovered npm publish tokens to inject the same malicious code into other packages owned by the same maintainer, creating a self-propagating worm. The worm also attempted to compromise PyPI packages if Python credentials were found, using a .pth file for persistence. This cross-ecosystem capability made it particularly dangerous. The affected packages are commonly used in AI agent tools and backend data services, increasing the value of compromised environments. Researchers noted the rapid cadence of republication—multiple malicious versions published within hours—as a key behavioral indicator.
Mitigation and Recommendations
Given the variety of attack vectors, organizations should adopt a comprehensive defense strategy. First, rotate all potentially exposed credentials immediately, including npm tokens, GitHub PATs, cloud provider keys, and CI/CD secrets. Revoke and reissue npm publish tokens with minimal scope. Second, audit all dependencies and lock files for unexpected version bumps or new preinstall/postinstall hooks. Use tools like npm audit, SCA scanners, and SBOM generation to maintain visibility. Third, enforce strict CI/CD policies: pin actions to specific commits, minimize OIDC token permissions, and use private registries or proxies to block recently published packages. Consider using pnpm with its built-in defenses, such as minimumReleaseAge and script blocking. Finally, educate developers about phishing tactics and implement phishing-resistant MFA (e.g., hardware keys). The era of trusting package registries blindly is over; continuous verification and behavioral monitoring are now essential.
These attacks demonstrate that the npm supply chain has become a prime target for sophisticated adversaries. From the worm-like propagation of Mini Shai-Hulud to the social engineering of the Qix phishing and the credential-driven spread of the Namastex Labs worm, the common thread is the exploitation of trust and automation. Developers and security teams must move beyond static defenses and adopt a culture of continuous verification, rotating credentials, auditing dependencies, and monitoring runtime behavior. The open-source ecosystem remains powerful, but its security now depends on collective vigilance and proactive measures.
