npm Supply Chain Attacks 2026: The Definitive Record of Every Documented Compromise

Between February 1 and July 15, 2026, Threadlinqs Intelligence documented 78 npm supply chain attacks spanning 218 malicious npm packages — self-replicating worms, CI/CD pipeline hijacks, AI-agent credential theft, and industrialized DPRK campaigns. Two throughlines dominate the window: a single crimeware crew, TeamPCP, linked to 40 of the 78 threats through the Shai-Hulud worm lineage, and North Korea, behind 23. This is the full reference: every wave, every technique, and every documented package, each mapped back to its threat record and attributed actor.

npm supply chain attacks by the numbers

• Window: February 1 – July 15, 2026 (5.5 months)
• Documented threats: 78
• Distinct malicious packages: 218
• Package IOCs recorded: 316
• Threats with a named actor: 41 of 78
• DPRK-attributed threats: 23 (29% of all; 56% of the attributed subset)
• Distinct threat actors tracked: 12
• Master-list records (documented package × threat): 308
• TeamPCP-linked threats (the worm lineage): 40

Timeline: the major npm supply chain attacks of 2026

How npm supply chain attacks changed in 2026: the novel techniques

The window's defining shift is that npm stopped being a place where attackers drop a single poisoned package and wait. It became a medium for self-propagating malware, a lever on the pipelines that publish, and a channel to reach AI agents. Eight technique families account for nearly everything documented.

Self-replicating npm worms — the Shai-Hulud lineage

For most of npm's history a compromise was a discrete event: one package, one bad version, one takedown. That model broke down with the Shai-Hulud worm family — the original Shai-Hulud first appeared in late 2025, and Mini Shai-Hulud, Miasma, Hades, and the compiled IronWorm escalated it sharply across this window — worms that harvest cloud and CI credentials at install time and then auto-republish through the very maintainers they just robbed. Socket and StepSecurity tracked the worm family to a crew tracked as TeamPCP, which Threadlinqs links to 40 of the 78 threats in the window; the Shai-Hulud and Miasma generations are carried as distinct operator labels within that lineage rather than as confirmed TeamPCP aliases.

The novelty is closed-loop propagation. Each generation kept the harvest-and-republish core while iterating tradecraft: Bun-runtime execution to sidestep Node tooling, orphan-commit payload staging so the malicious code never appears in the visible Git history, and TruffleHog secret sweeps across the compromised host. Miasma trojanized 57 npm packages across 286+ versions using a 157-byte binding.gyp "Phantom Gyp" that runs a 4–5MB ROT-N-obfuscated index.js during install, harvests AWS/GCP/Azure/Vault/Kubernetes/GitHub-Actions credentials, then propagates across CI/CD (TL-2026-1234). By July the lineage had crossed into compiled Rust with IronWorm (TL-2026-1379), hardening the payload against JavaScript-level scanners entirely.

Install-time and import-time execution without a visible install script

Attackers systematically abandoned the obvious postinstall hook — the first thing any scanner checks — for triggers that evade install-script analysis. Phantom Gyp is the standout: drop a binding.gyp into a pure-JS package and npm invokes node-gyp, whose command-substitution syntax executes code with no lifecycle script declared at all. Others moved execution into module require()/import (with sideEffects arrays to defeat tree-shaking), into preinstall so theft fires before code even unpacks, or into a downloaded Bun runtime that never touches Node-level tooling.

node-ipc 9.1.6/9.2.3/12.0.1 (~822K weekly downloads) fired its credential stealer on module require() rather than any lifecycle script, exfiltrating cloud, SSH, Kubernetes, and Terraform secrets over DNS TXT queries (TL-2026-0518). This pressure was the direct cause of npm 12 flipping lifecycle scripts, node-gyp, Git dependencies, and remote tarballs to opt-in (TL-2026-1163).

CI/CD trusted publishing as the new blast radius

The highest-leverage attacks stopped stealing npm tokens and hijacked the pipelines that publish. The recurring primitive is the GitHub Actions "pwn-request": a pull_request_target workflow that checks out untrusted PR code while holding base-repo secrets. From there, operators read OIDC tokens out of runner memory (/proc/<pid>/mem) and publish through the project's own trusted-publisher workflow — so the poisoned tarball carries valid SLSA provenance.

The AsyncAPI compromise is the clean example: an unpatched pull_request_target flaw leaked the asyncapi-bot PAT, then npm OIDC trusted publishing shipped five malicious @asyncapi versions (~2.9M weekly downloads) with provenance attesting the workflow, not the malicious commit (TL-2026-1360, TL-2026-1299). Automated worms weaponized the same primitive at scale: Megalodon touched 5,561 repos in six hours (TL-2026-0556) and a poisoned codfish/semantic-release-action exposed 1,442 repos. The Axios compromise took a different route — a stolen legacy NPM_TOKEN published the backdoor, which then reached OpenAI's macOS signing pipeline through a floating ^1.14.0 version range in the signing CI (TL-2026-0351), forcing an Apple Developer ID certificate rotation.

AI as both target and weapon

2026 is where AI entered the supply chain from both directions at once. As a target, AI-agent credentials and configs became the prize: OpenAI Codex OAuth tokens, Claude Code MCP OAuth bearer tokens, the Claude sandbox filesystem, and whole frameworks (Mastra, @mistralai). A Mitiga PoC's postinstall hook rewrote mcpServers URLs in ~/.claude.json to route Claude Code's MCP traffic through an attacker mitmproxy, seeded directory-trust flags, and injected a SessionStart hook to steal persistent OAuth bearer tokens for Jira and GitHub over MCP (TL-2026-0712).

As a weapon, AI generated the malware ("slop" packages, language-aware payloads), pre-registered the plausible package names that LLMs hallucinate so coding agents fetch them — a technique now called slopsquatting or HalluSquatting — and manipulated the LLM reviewers themselves. The package shai_hulululud embedded a fake SYSTEM-OVERRIDE prompt-injection and token-flooding to blind LLM scanners (TL-2026-0829). Socket, which first flagged the package, detailed the same prompt-injection technique. It is defense being attacked at its own layer.

Maintainer-trust and account-takeover tradecraft

Rather than exploit code, attackers exploited the trust model around publishing. Documented techniques include a stolen legacy NPM_TOKEN being honored over OIDC Trusted Publishing (bypassing 2FA), dormant contributor access that was never revoked, expired recovery-domain re-registration, social-engineered maintainer handovers, and abuse of the npm bypass_2fa API.

Nearly universal was "phantom-dependency injection" paired with "clean-decoy pre-staging": leave the trusted package's own code untouched and hide the malice one hop away, in a freshly added dependency whose benign decoy version was published hours earlier to defeat novelty heuristics. Backdoored axios@1.14.1/0.30.4 were bit-for-bit identical to the clean releases except one package.json line adding phantom dependency plain-crypto-js@^4.2.1, whose clean 4.2.0 decoy had been staged roughly 18 hours earlier; the maintainer's stolen legacy token was honored over OIDC despite MFA (TL-2026-0305, TL-2026-0397).

Novel C2 and exfiltration channels

Operators fled takedown-prone domains for infrastructure that is immutable, decentralized, or indistinguishable from legitimate traffic. Blockchain dead-drops resolved C2 that cannot be seized: PolinRider's tailwind-color-shades/safe-validate loaders queried TRON and Aptos and decrypted an XOR payload from Binance Smart Chain burn-address transactions — "EtherHiding" — to resolve C2 with no static domain (TL-2026-1215). Legitimate services became payload hosts (Hugging Face, IPFS, GitHub Releases and the Contents API, jsonkeeper and rentry pastes).

Exfiltration hid where egress filters do not look. The @injectivelabs backdoor base64-encoded stolen BIP-39 mnemonics into the X-Request-Id HTTP header, shaped to resemble gRPC-Web traffic (TL-2026-1149). Others used DNS TXT queries, WebRTC P2P, and Cloudflare Worker proxies to survive egress filtering.

DPRK industrialization of developer-targeting campaigns

North Korea moved from bespoke drops to automated malware factories. The Contagious Interview, PolinRider, and WageMole clusters mass-produced malicious packages in escalating waves — 67, then 108-package/261-version runs, then ~200-package OtterCookie batches — delivered through fake-recruiter coding-assessment lures on LinkedIn, Fiverr, and Upwork, plus brandjacking, VS Code tasks.json folderOpen auto-run, malicious git pre-commit hooks, and backdoored IDE-marketplace extensions.

PolinRider published 108 malicious packages and extensions across 162 artifacts spanning npm, Packagist, 80+ Go modules, and the Chrome Web Store, appending obfuscated JS to build-config files (tailwind.config.js, next.config.mjs) and abusing .vscode/tasks.json runOn: folderOpen to auto-run BeaverTail/InvisibleFerret the moment a repo opened (TL-2026-1055, TL-2026-1143). DPRK accounts drove 23 of the 78 threats, and the crypto-theft subset (UNC1069 and PolinRider) went straight for wallet keys.

Typosquatting, dependency-confusion, and cross-ecosystem registry abuse

The classic name-based vectors persisted but grew more sophisticated: inflated version numbers to win dist-tag resolution, brandjacking via suffix or embedding rather than raw typos, dependency-confusion against real internal corporate namespaces, and coordination across npm, PyPI, crates.io, Go, and the AUR under one toolchain. Two newer twists stand out. The Atomic Arch campaign legitimately adopted 400+ (later 1,500+) orphaned AUR packages and modified their PKGBUILD hooks to run npm install atomic-lockfile@1.4.2, whose preinstall hook executes a bundled Rust ELF that steals credentials and installs an eBPF rootkit — a Linux distro repo bridged into npm (TL-2026-0788, TL-2026-0979). Separately, operators abused the npm registry itself as a free CDN, hosting adware and DDoS-botnet payloads in packages with no install hook at all.

Who is behind the npm supply chain attacks?

North Korea dominates. Of the 78 threats, 23 (29%) are DPRK-attributed; of the 41 with a named actor, 23 (56%) trace to DPRK clusters. The rest of the attributed set is financially motivated crimeware, and 37 threats carry no confident attribution at all.

The DPRK clusters overlap by design. Lazarus Group carries the most links (18 threats), reflecting its role as the umbrella under which the sub-clusters operate. Contagious Interview (11 threats) runs the fake-recruiter coding-assessment lures. WageMole (10) handles the IT-worker fraud angle. UNC1069 — the Sapphire Sleet cluster — and APT38 (9 each) drive the financially motivated theft, with UNC1069 behind the Axios and Mastra compromises. PolinRider (4) is the crypto-theft and cross-ecosystem specialist. The unifying motive is money — cryptocurrency wallet keys and developer credentials that convert to access — not espionage in the traditional sense.

The financially motivated crimeware side is defined by one crew. TeamPCP is the single biggest throughline in the entire dataset, linked to 40 threats via the self-replicating worm family. Where DPRK mass-produces discrete packages, TeamPCP built self-propagating malware — the difference between a factory and a contagion. The Shai-Hulud operators (4) and Miasma operators (3) are tracked as related-but-distinct labels for generations of the same lineage. ShinyHunters (15) surfaces around the data-theft and extortion tail, and TrapDoor and PhantomRaven (1 each) round out the cross-ecosystem crypto-stealer crews.

Attribution here is provisional. Worms muddy it further: once a self-propagating payload harvests one maintainer's token and republishes, the "actor" behind a given malicious version may be an automated loop rather than a human operator making a decision. Treat the named-actor column in the master list as an assessment, not a verdict.

How to detect and prevent npm supply chain attacks

The following detections are drawn from the Threadlinqs platform and map to the threats above. Trim the field names to your schema.

Mini Shai-Hulud fires its payload from a lifecycle hook spawning node/bun/python on a staged script — the earliest observable in the kill chain (TL-2026-0446):

sigmatitle: Mini Shai-Hulud npm/pip Preinstall Hook Spawns node-bun on setup.mjs or router_runtime.js
status: experimental
description: Detects npm/yarn/pnpm/pip lifecycle hooks invoking node, bun, or python on
  setup.mjs, router_runtime.js, or the Mini Shai-Hulud trojanized packages (intercom-client,
  @cap-js/*, mbt, lightning).
references:
    - https://socket.dev/blog/intercom-s-npm-package-compromised-in-supply-chain-attack
logsource:
    category: process_creation

The credential sweep that follows install — a node/bun process reading .npmrc, .aws/credentials, .kube/config, .vault-token, and terraform.tfstate within minutes of an install firing (TL-2026-0446):

kqllet credPaths = dynamic([".npmrc", ".yarnrc", "hosts.yml", ".docker/config.json",
    ".aws/credentials", ".kube/config", ".vault-token", ".env", ".envrc",
    "terraform.tfstate", ".gitconfig"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileAccessed", "FileOpened", "FileRead")
| where InitiatingProcessFileName has_any ("node", "node.exe", "bun", "bun.exe",
    "python", "python3", "npm", "npm.cmd")
| where FileName has_any (credPaths)

Worm propagation is visible as a burst of patch-version publishes from a maintainer dormant for 30+ days, or GitHub repos created with the worm's signature description (TL-2026-0446):

kqllet poisonRepoPrefixes = dynamic(["ghola-melange-", "mentat-melange-", "powindah-sietch-"]);
let poisonDescription = "A Mini Shai-Hulud has Appeared";
GitHubAuditLog_CL
| where TimeGenerated > ago(24h)
| where action_s in ("repo.create", "repo.transfer", "public_repo.create")
| extend RepoName = tostring(repo_s), Description = tostring(description_s)
| where Description has poisonDescription
   or RepoName startswith_cs "ghola-melange-"

For the AI-agent surface, watch MCP config files in AI coding-assistant directories for injection (TL-2026-0147):

kqlDeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (".claude", ".cursor", ".continue", ".codeium", ".windsurf")
| where FileName in~ ("settings.json", "mcp.json", "config.json", "mcp_config.json")
| where ActionType in ("FileCreated", "FileModified")

And the exfil tail — Node fetching Pastebin raw URLs mid-install as a dead-drop C2 resolver (TL-2026-0152):

splindex=proxy sourcetype="bluecoat:proxysg:access:syslog" OR sourcetype="squid:access"
| search cs_host="pastebin.com" cs_uri_path="/raw/*"
| eval is_known_deaddrop=if(match(cs_uri_path, "(CJ5PrtNk|0ec7i68M|DjDCxcsT)"), 1, 0)
| stats count as paste_fetches, sum(is_known_deaddrop) as known_hits by src_ip, cs_User_Agent
| where paste_fetches >= 1

Beyond detection, the hygiene that would have blunted most of this window:

• Enforce provenance. Require npm audit signatures and reject packages without valid SLSA provenance — noting that provenance attests the workflow, not intent, so pair it with publish-source review.
• --ignore-scripts by default. Disable lifecycle scripts in CI and local installs; adopt an explicit opt-in allowlist for the handful of packages that genuinely need them.
• Pin and verify. Commit lockfiles, pin exact versions, and enforce integrity hashes; do not float dependency ranges that let a phantom dependency slip in.
• Least-privilege CI tokens. Scope publish tokens narrowly, prefer short-lived OIDC over long-lived legacy tokens, and revoke dormant maintainer and contributor access on a schedule.
• Adopt the npm 12 defaults. Lifecycle scripts, node-gyp, Git dependencies, and remote tarballs are now opt-in — keep them off and allowlist deliberately.

Every documented npm package: the master list

The table below is the full package-level record for the window — every documented malicious package and version, sorted by TL number, each row linking to its threat and enriched with the attributed actor and that actor's country and motive. Use it as a blocklist source and a triage reference; the "Actor" column is an assessment, not a confirmed verdict.

Sorted by threat ID (Threadlinqs TL number). Click any column header to re-sort; type to filter. Every TL number links to the full enriched threat record; every package links to its npm registry page; every attributed actor links to its actor profile. Vulnerable/fixed versions mirror each threat's // affected section. “Actor threats” is the number of threats attributed to that actor across the Threadlinqs corpus.

How to protect against npm supply chain attacks: a checklist

Prioritized for a security team working from the top down:

• Now: Cross-reference the master list against your lockfiles and CI caches. Any match means assume credential exposure, not just a bad dependency.
• Now: Rotate every secret reachable from a build runner — cloud keys, NPM_TOKEN, GITHUB_TOKEN, Vault tokens, kubeconfigs. The worms harvest at install time, so exposure predates detection.
• This week: Audit pull_request_target workflows. Remove secret access from any workflow that checks out untrusted PR code; this single primitive drove the highest-impact compromises.
• This week: Set --ignore-scripts in CI and disable node-gyp for pure-JS dependency trees; a stray binding.gyp should never execute.
• This week: Inventory AI-agent configs (~/.claude.json, .cursor/, .continue/, .windsurf/) as sensitive credential stores and alert on modification.
• Ongoing: Enforce lockfile pinning with integrity hashes, require npm audit signatures, and move all publish flows to short-lived OIDC with legacy tokens revoked.
• Ongoing: Revoke dormant maintainer and contributor access quarterly. Several compromises rode accounts that had not published in months.
• Ongoing: Egress-filter and log DNS TXT volume, non-standard outbound ports, and traffic to paste sites and blockchain RPC endpoints from build hosts.

Frequently asked questions

What is an npm supply chain attack?

An npm supply chain attack compromises a trusted package in the npm registry — by stealing a maintainer's publish token, hijacking a dormant account, or poisoning the CI/CD pipeline that publishes it — so that every project installing the package also pulls attacker code. Because a single popular package can be a dependency of millions of projects, one compromise cascades across the ecosystem.

How many npm packages were compromised in 2026?

Between February 1 and July 15, 2026, Threadlinqs Intelligence documented 78 distinct npm supply chain attacks involving 218 unique malicious packages across 308 documented package records. The full, sortable list — with vulnerable and fixed versions and the attributed threat actor — is in the master table on this page.

What is the Shai-Hulud npm worm?

Shai-Hulud is a family of self-replicating npm worms — including Mini Shai-Hulud, Miasma, Hades, and the compiled-Rust IronWorm — that harvest cloud and CI credentials at install time and then auto-republish through the maintainer accounts they just stole from. It is the first true worm behavior in the npm ecosystem, turning one compromise into self-propagating malware. Threadlinqs links the lineage to a crew tracked as TeamPCP, present in 40 of the 78 documented attacks.

Who is behind the 2026 npm supply chain attacks?

Attribution splits two ways. North Korea (DPRK) accounts for 23 of the 78 attacks (56% of those with a named actor), spread across the UNC1069/Sapphire Sleet, APT38, Lazarus Group, Contagious Interview, WageMole, and PolinRider clusters, motivated by cryptocurrency and credential theft. The other pole is financially motivated crimeware led by TeamPCP and its self-replicating worm family.

What is a binding.gyp "Phantom Gyp" attack?

Phantom Gyp is an install-time execution technique that avoids the obvious postinstall hook. An attacker drops a small binding.gyp file into a pure-JavaScript package; npm then invokes node-gyp during install, and node-gyp's command-substitution syntax executes attacker code without any lifecycle script being declared. The Miasma worm used a 157-byte binding.gyp to trojanize dozens of packages across hundreds of versions.

What is slopsquatting?

Slopsquatting (also called HalluSquatting) is a name-based attack that weaponizes AI: attackers pre-register the plausible-but-nonexistent package names that large language models hallucinate, so that when an AI coding assistant confidently suggests one of those names, the developer installs attacker-controlled code. It is typosquatting adapted to the era of AI-generated dependency suggestions.

How do I protect against npm supply chain attacks?

Enforce package provenance (npm audit signatures and SLSA), set --ignore-scripts by default in CI, pin exact versions with integrity hashes in committed lockfiles, scope publish tokens narrowly and prefer short-lived OIDC over legacy tokens, revoke dormant maintainer access, and adopt the npm 12 defaults that disable lifecycle scripts, node-gyp, Git dependencies, and remote tarballs. The remediation checklist on this page prioritizes these for a security team.

Track this in real time

Sources and further reading

• Socket — Axios npm package compromised
• Endor Labs — Shai-Hulud: inside the Bitwarden CLI supply-chain attack
• Aikido — Mini Shai-Hulud has appeared
• Wiz — Miasma supply-chain attack targeting Red Hat npm packages
• Snyk — node-gyp compromise: self-propagating npm worm (binding.gyp)
• Socket — Mastra npm packages compromised
• Datadog Security Labs — @injectivelabs/sdk-ts backdoor
• Socket — AsyncAPI supply-chain attack
• Socket — jscrambler supply-chain attack
• Google Cloud / Mandiant — North Korea targets the Axios npm package
• Datadog Security Labs — node-ipc npm malware analysis
• The Hacker News — npm 12 disables install scripts by default
• The Hacker News — new HalluSquatting attack tricks AI coding assistants
• The Hacker News — cross-ecosystem PyPI/npm compromise wave
• Aikido — Red Hat npm packages compromised by credential-stealing worm
• Sonatype — Atomic Arch npm campaign adds malicious dependency
• The Hacker News — malicious npm package steals files from AI sandbox
• Wiz Threat DB — SANDWORM_MODE typosquatted npm packages hijack CI workflows
• Aikido — GlassWorm returns: Unicode attack across GitHub, npm, VS Code
• CISA — supply-chain compromise impacts the Axios npm package
• CISA — cybersecurity advisories
• Google Cloud / Mandiant — DPRK adopts EtherHiding (blockchain dead-drops)