Import-Time Malware

Malware that executes when a package or module is loaded, rather than waiting for an install hook or separate launcher. In software supply chains, this makes ordinary imports in tests, builds, and runtime services a viable attack trigger.

Expanded Definition

Import-time malware is malicious code that executes as soon as a package, module, or plugin is loaded. In the NHI and software supply chain context, that means ordinary CIS Controls v8 aligned activity such as unit tests, build steps, dependency inspection, or service startup can become the trigger point. The risk is not limited to installation events; the payload can hide inside import side effects, transitive dependencies, or auto-loaded extensions.

Definitions vary across vendors on whether the term should include purely opportunistic payloads, dependency confusion loaders, or package-level persistence mechanisms, but the operational pattern is consistent: execution occurs before an operator expects active code to run. In practice, that makes the package boundary part of the trust boundary, which is why NHI governance treats imports, runtime bootstrap code, and secret access paths as security-sensitive.

The most common misapplication is assuming a package is safe because the install step was clean, which occurs when defenders only scan deployment artifacts and ignore what happens at module import time.

Examples and Use Cases

Implementing package screening rigorously often introduces friction in developer workflows, requiring organisations to weigh faster dependency adoption against the cost of deeper inspection and controlled execution environments.

• A Python dependency runs a hidden routine on import and attempts to read environment variables that contain API keys.
• A build tool loads a plugin that executes before tests begin and exfiltrates tokens from the CI runner, similar to patterns seen in the Shai Hulud npm malware campaign.
• A service imports a convenience library at startup, and the library silently contacts an external endpoint to stage additional payloads.
• A developer workstation loads a compromised module during local validation, leaking credentials that later enable broader access, a failure mode reflected in the CircleCI Breach analysis.
• An agentic workflow imports a tool adapter and the adapter executes before policy checks can apply, creating an execution path outside expected approval flows.

These scenarios show why import-time behaviour matters across both traditional software and NHI-heavy automation stacks. Security teams often pair dependency allowlists with runtime controls, code review of plugin entry points, and secret isolation so that a malicious import cannot immediately harvest credentials.

Why It Matters in NHI Security

Import-time malware is especially dangerous in NHI environments because service accounts, API keys, tokens, and certificates are frequently present wherever code runs. When a malicious module executes during import, it can reach secrets before application logic, monitoring, or response tooling has fully initialized. That makes the attack especially effective in CI/CD systems, build containers, ephemeral runners, and agent runtimes where credential exposure is already concentrated.

NHIMG research shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, which creates exactly the conditions import-time malware exploits. Combined with NHI sprawl and weak visibility, a single poisoned dependency can turn a routine import into a credential theft event. This is why NHI management emphasizes least privilege, hardened build environments, and rapid revocation paths alongside dependency governance.

Practitioners should treat this term as a post-compromise signal as much as a prevention concept: organisations typically encounter import-time malware after tokens are already abused, at which point the damage has moved from code inspection to incident containment.

Related resources from NHI Mgmt Group

• What do security teams get wrong about import-time malware?
• How should teams choose between bulk import and just-in-time CIAM migration?
• What breaks when malware can adapt its commands in real time?
• Import-time execution