2026 has been the worst year yet for npm supply-chain attacks, driven by the "Shai-Hulud" worm and its copycats: malware that steals developer and CI credentials, then uses them to publish infected versions of more packages automatically. In the August 2026 wave targeting keyv and related caching libraries, ArmorCode counted more than 440 compromised packages within an hour, and Singapore's Cyber Security Agency reported over 1,300 affected package versions with a combined reach of around 2 billion monthly downloads.
How these attacks work
- Steal a maintainer's or CI pipeline's npm token.
- Publish a poisoned version of a legitimate, popular package.
- The install script runs on every machine that installs it, harvesting more tokens and cloud keys.
- Self-propagate: use the stolen tokens to infect the next set of packages.
According to Palo Alto Networks' Unit 42, the original Shai-Hulud in September 2025 marked the end of npm attacks being a "nuisance". In mid-2026 the worm's source code was reportedly released publicly, and clones followed quickly.
What to change today
- Install with
npm cifrom a committed lockfile, so a new malicious version can't slip in during a build. - Delay new versions: don't auto-adopt releases published in the last few days. Most poisoned versions are caught and pulled within hours.
- Disable install scripts by default where you can, and allow them per package.
- Protect publishing: 2FA on npm, short-lived and narrowly scoped tokens, and trusted publishing from CI where available.
- Keep secrets out of developer machines' environment and out of CI steps that don't need them.
- If you're hit: rotate every credential the affected machine or pipeline could reach, then rebuild from clean. The CSA's advice says the same.
Shipping JavaScript safely
At NextGen Fusion, our Node.js development company in Lucknow, these controls are standard on every client project, because one bad dependency can expose a whole business.
