NPM Supply Chain Attack: Active Worm Stealing Tokens, SSH Keys, and Credentials

🚨 Emergency DevSec Station update.

There’s an active npm supply chain attack happening right now.

Malicious npm packages are running install scripts that quietly steal:
 • SSH keys
 • AWS credentials
 • GitHub tokens
 • Browser passwords
 • Crypto wallets

From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm across the npm ecosystem.

This is not theoretical. It’s already in the wild.

👉 Immediate fix:
 Run
 npm config set ignore-scripts true

This disables install scripts and blocks the main attack path.

If you work in JavaScript, Node.js, DevSecOps, or application security, take action now and tell your team.

Watch the full 2 minute breakdown and share this with anyone who installs npm packages.

#npmSecurity #SupplyChainAttack #DevSecOps #AppSec #JavaScriptSecurity #CyberSecurityAlert

Follow Tanya:

• https://shehackspurple.ca
• https://news.letter.shehackspurple.ca
• https://youtube.com/@shehackspurple
• https://linkedin.com/in/tanya-janca
• https://tanyajanca.com

Episode Transcript

SPEAKER_00 (00:00):
Hi, I'm Tanya Janka, also known as SheX Purple, and
I'm interrupting our regularDevSec station programming
because I don't feel that thiscan wait.
There's an active NPM supplychain attack happening right
now.
I know there's been a lot ofthem recently, but this one is a
big one, and I wanted to tellyou about it.
Packages that look completelynormal and legitimate are being

(00:21):
compromised and published withmalicious versions that are
stealing your credentials.
It's the moment that you run NPMinstall when it steals it via
post-install script.
They're taking SSH keys, AWScredentials, GitHub tokens,
browser passwords, cryptowallets, literally everything
that it can grab, it is stealingfrom you.
And then it will use yourpublished token to infect every

(00:46):
single package that youmaintain.
I would call this attack a worm.
So here's what I would like youto do right now.
If you could open your terminaland run the following command,
which obviously you will decidefor yourself, but this is a
request, not a demand.
npm config set, ignore dashscripts.

(01:07):
True.
What this will mean is thatpost-install scripts don't run
anymore.
So I just want you to run onecommand which tells npm to never
automatically run a post-installscript again without your
explicit permission.
I realize that occasionally alegitimate package will break as
a result of this.
I that's it might sound weird,but I want this.

(01:29):
Um, this will be friction, and Iwant us to treat it as a
feature, a security feature, nota bug.
It's alerting you thatsomething's happening.
It means that you have toconsciously decide to trust the
script before it runs on yourmachine.
Um, that's how this would workfrom now on.
So instead of post-installscripts that are potentially
malicious running automatically,the post-install script would

(01:50):
come to your attention.
You review it and decide that itis good.
Um, I would hope that you couldset this for every org, for
every project, for everydeveloper on your team.
That is what I would like.
I want you to set it foryourself today.
Um I'd like you to talk to yourteam about setting it for
everyone as soon as possible.
Um, on top of this, if you couldrun a software composition

(02:12):
analysis tool, also known asSCA, um, they can catch these
sort of things fairly often,fairly quickly.
If you could do both, you'd geteven better results.
Uh, thank you very much.
Um, I will be back with yourregularly scheduled programming
next episode.
Thank you.