Topic starter
02/08/2026 11:23 am
TL;DR: npm v12 will block automatic install scripts, Git dependencies, and remote URL dependencies by default, but OXSecurity argues those changes still leave account takeover, native builds, and publish-time intent detection unresolved as Shai-Hulud variants keep evolving. The deeper risk is that platform-level trust controls lag behind attacker adaptation, especially when compromised maintainers can still ship malicious releases.
Editorial analysis by NHI Mgmt Group, based on content published by OXSecurity: “npm Is Fighting the Right War With the Wrong Weapons”.
Key questions
Q: What breaks when npm defaults block install scripts but maintainers are already compromised?
A: The control fails because the malicious code ships as a trusted release, not as an obviously unsafe install script.
Q: Why do account takeovers make npm supply chain attacks more dangerous than package-level malware?
A: Account takeover turns the registry itself into a delivery channel.
Q: What are the signs that a package registry is failing to stop malicious releases?
A: Watch for repeated impersonation names, packages that contain clear exfiltration logic, unusual native build behaviour, and releases that immediately spread into popular dependency chains.
Practitioner guidance
- Strengthen maintainer account controls Enforce phishing-resistant MFA, short-lived tokens, and scoped publishing permissions for every package maintainer and release automation identity.
- Inspect build and import execution paths Review packages that use native builds, require-time execution, or dependency resolution paths that can still run code even when lifecycle scripts are blocked.
- Add publish-time package inspection Scan new releases for exfiltration keywords, suspicious file access, impersonation names, and anomalous release patterns before they reach downstream consumers.
Bottom line: npm v12 reduces some install-time abuse, but it does not resolve account takeover, native build execution, or malicious publishing as supply chain risks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:40 pm
Package trust has become an identity problem before it is a malware problem. npm defaults can reduce one class of execution path, but they do not answer who is allowed to publish, who can be impersonated, or which tokens can be abused to ship malicious code. That is why NHI and IAM governance now sit inside software supply chain security, not beside it. Practitioners should treat registry accounts, CI identities, and maintainer tokens as governed identities with lifecycle control, not as incidental credentials.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
A question worth separating out:
Q: What should teams do first when malicious npm packages execute on trusted developer machines?
A: Treat the host as credential-compromised until proven otherwise. Contain the endpoint, identify what secrets were present at execution time, and rotate cloud tokens, registry credentials, SSH keys, and session material before trusting any subsequent build or deployment activity.
👉 Read our full editorial: npm supply chain attacks expose the limits of v12 security defaults