Is npm Safe? Practitioner Guide to npm Security 2026

Direct dependencies listed in your root package.json are still permitted to use exotic sources. Attackers can update the lockfile to specify a new source location (in the resolved key) that they control, and set the SHA512 integrity value accordingly to avoid detection. Furthermore, JavaScript package managers allow users to install packages from unconventional sources, such as GitHub gists or directly from source code repositories. Both JavaScript package managers, Yarn and npm, were found to be susceptible to lockfile injection attacks. In September 2019, Liran Tal disclosed security research about inherent security risks https://gleecus.com/services/data-artificial-intelligence/ml-ai-services/ with package lockfiles in developer workflows. Malicious actors can inject compromised packages into your lockfiles through pull requests, potentially compromising your entire application during the next installation.

Even with post-install scripts disabled, git-sourced dependencies can introduce unreviewed, unversioned code into your project. Bun disables postinstall scripts by default and maintains its own internal allow-list of packages that are allowed to run postinstall scripts. As of pnpm 10.26+, allowBuilds is the preferred replacement for both onlyBuiltDependencies and ignoredBuiltDependencies (the earlier settings are https://www.inrecognition.org/what-are-the-trends-in-workplace-learning-and-development/ deprecated). By disabling post-install scripts, you can mitigate the risk of such attacks by preventing the execution of potentially harmful code during the installation process. Post-install scripts are a common and recurring attack vector for supply chain attacks.

Continuous updates on how to stay safe from NPM supply chain attacks Here’s their talk on AI powered malware hunting at scale, Jan 2025. Socket.dev is a security platform that protects code from both vulnerable and malicious dependencies. But they also have the disadvantages of being more complex to setup https://medhaavi.in/what-is-a-striver-sde-sheet/ and maintain, and can be more expensive (cost of storage and bandwidth) to use.

Cyprus Airways Data Breach: Hackers Claim Access to Real-Time Systems and Passenger Records

That’s nearly half a million in a single year. Shadowserver reports 90,300 instances still vulnerable. The supply chain audit walkthrough is where the workflow above gets tested against a real dependency tree. Model poisoning, prompt injection in dependency suggestion, and AI agents that auto-merge dependency updates without human review are the natural extension of the trust-flow exploit pattern. In organisations still running periodic audits and weekly security reviews, the workflow isn’t in place because the role isn’t either. The 2025 Gartner supply chain prediction (which we revisited in detail recently) was that 45% of organisations globally would experience supply chain attacks by 2025.

We recommend reviewing pnpm’s supply‑chain security docs for further configuration schematics. From v10+, pnpm disables postinstall scripts by default and supports an allow‑list or re‑enable mechanism. The details of each incident are still evolving, but the pattern is stable enough that we can extract a set of durable practices that should become part of every JavaScript developer’s muscle memory. They abuse npm’s lifecycle hooks as an execution surface; they weaponize developer workstations and CI/CD infrastructure as hop points; and they treat cloud credentials, tokens, and secrets as the real objective.

• The eslint-scope7 incident in 2018 demonstrated the risks of compromised npm accounts when attackers published malicious code after stealing developer credentials.
• Luckily, there is a way to tell both Yarn and npm to adhere to a specified set of dependencies and their versions by referencing them from the lockfile.
• The dependency was never vulnerable; it was hijacked.
• If an attacker has already published a malicious package under that hallucinated name, installing it compromises your system silently.
• Follow these developer security best practices around npm, package maintenance and secure local development to mitigate security risks.

The “trust-flow exploit” pattern

• Useful for the CVE class; misses supply chain attacks for the structural reasons above.
• CI/CD pipelines and automated builds that run npm install without version pinning can pull malicious updates automatically.
• Revoke and regenerate npm tokens, GitHub PATs, SSH keys, and cloud provider credentials.
• Mobilisation is the automated CI/CD pipeline that operationalises everything else.
• Shadowserver reports 90,300 instances still vulnerable.

These malicious packages exploit common typing errors or visual similarities to trick developers into installing them instead of the legitimate packages they intended to use. The npm CLI can provide information about the freshness of dependencies you use with regards to their semantic versioning offset. If you use packages that rely on lifecycle scripts for legitimate reasons, you can use a plugin like @lavamoat/allow-scripts to create an allowlist of packages authorized to run lifecycle scripts.

npm audit (baseline detection)

• Private registries also provide audit trails showing exactly which packages entered your environment and when.
• Limiting the files in an npm package helps prevent malware by reducing the attack surface, and it avoids accidental leaking of sensitive data
• Sonatype Repository Firewall (and Nexus Lifecycle) operate at the enterprise level, blocking malicious packages before download into the build environment based on Sonatype’s continuous research into open source malware.
• Socket.dev is a security platform that protects code from both vulnerable and malicious dependencies.
• Configure npm, pnpm, Bun, or Yarn to delay package installations by setting a minimum release age in your package manager’s configuration file.
• The npm CLI can provide information about the freshness of dependencies you use with regards to their semantic versioning offset.

Together, Shai-Hulud and SHA1-Hulud define a clear playbook for modern supply chain malware. It actively hunts for AWS, Azure, and GCP credentials and, in some cases, even attempts container breakouts, privilege escalation on the host, and destructive “wiper” behavior against a user’s home directory. Once the package is installed, the worm attempts to convert the victim into an attacker‑controlled GitHub Actions self‑hosted runner, injects malicious workflows into repositories, and uses them to run arbitrary commands and siphon npm and GitHub secrets. In September 2025, the original Shai-Hulud campaign used tampered versions of packages like ngx-bootstrap, ng2-file-upload, and @ctrl/tinycolor to deliver a worm-like payload through npm lifecycle scripts. The following is a curated, practical, security‑focused npm package manager hardening list of recommended practices for secure local development and open source software maintainers’ processes.