npm Package Supply Chain Attacks
The trouble started on April 22nd, when researchers identified a self-propagating worm targeting npm packages — the kind of attack that doesn't just compromise one library but uses each infected package as a launchpad to reach the next. The mechanism was credential theft: developer tokens, the keys that let you push code to registries and pipelines, harvested quietly and at scale. A week later, on April 29th, the same attack surface produced a second, distinct incident: npm packages linked to SAP software were found compromised in what appeared to be a coordinated credential-stealing campaign. Two events, one week apart, both in the same ecosystem, both chasing the same prize. That's not coincidence — that's a pattern establishing itself.
If confirmed, here is what this means. The npm registry, which underpins an enormous share of JavaScript and Node.js development worldwide, is being actively treated as an attack vector rather than an infrastructure detail. Developers who have published packages — not just those who consume them — are in the crosshairs. Stolen tokens don't just expose one project; they give attackers the ability to inject malicious code into any package that developer maintains, poisoning every downstream user silently. The SAP connection is particularly pointed: enterprise tooling built on compromised open-source dependencies creates a supply chain that runs from a hobbyist's side project straight into corporate infrastructure. Security teams that have focused on perimeter defenses will find that the boundary they were guarding was the wrong one.
Watch for disclosure of specific token abuse — evidence that stolen credentials were actually used to push malicious updates — and any response from npm or GitHub on registry-level protections, either of which would sharply raise confidence in how serious this has already become.
Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised
Hundreds of packages across npm and PyPI have been compromised in a new Shai-Hulud supply-chain campaign delivering credential-stealing malware targeting developers. [...]
Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing
Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The
<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.
TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI,
Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →