Notifications
Clear all
Topic starter
19/08/2026 3:53 pm
TL;DR: A full phishing and bulk-mail framework was hidden inside obfuscated npm versions 1.0.299 through 1.0.307 of nolimit-agent, using Microsoft 365 device-code approval to read mail through Graph, impersonate senders, and beacon to api.nolimitent.xyz, according to Xygeni. Package distribution now carries a direct identity abuse path, not just a malware delivery risk.
NHIMG editorial — based on content published by Xygeni covering the nolimit-agent npm supply chain attack: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- The package line spanned versions 1.0.299 through 1.0.307, released over four days from 2026-06-26 to 2026-06-29.
- The package’s main entry resolved to .ad/x0.js, one of about 86 files in the hidden directory.
Questions worth separating out
Q: How should security teams handle package installs that can trigger identity flows?
A: Treat any package that can initiate OAuth, SSO, or device-code flows as a potential identity control boundary, not just a software artifact.
Q: Why do device-code approvals create risk when the requester is untrusted?
A: Device-code flow shifts trust from a password to user approval, which is useful for constrained devices but dangerous when the requester is malicious.
Q: What breaks when package metadata does not reflect the real runtime path?
A: Security review becomes misleading because install hooks, readme text, and visible files can look harmless while the actual code executes elsewhere.
Practitioner guidance
- Restrict device-code authentication where it is not operationally required Apply Conditional Access and sign-in policies to block or challenge device-code flows for user populations and environments that do not need them, especially developer and build contexts.
- Inspect packages with hidden runtime entry points Flag npm packages whose main or bin fields resolve into dot-prefixed directories, especially when those directories contain dense obfuscation or code-decoding patterns.
- Correlate device-code sign-ins with mailbox enumeration Alert when a successful device-code sign-in is followed quickly by Graph reads of inbox and sent items, because that sequence indicates delegated mailbox abuse.
What's in the full analysis
Xygeni's full analysis covers the operational detail this post intentionally leaves for the source:
- The package layout, hidden directory structure, and file-level indicators that reveal the malicious runtime path.
- The Microsoft 365 device-code and Graph sequence used to turn user approval into mailbox access.
- The operator infrastructure, URL-spoof patterns, and reconnaissance routines that support delivery and impersonation.
- The indicator list and hunting guidance needed for npm, proxy, DNS, and Microsoft 365 telemetry.
👉 Read Xygeni's analysis of the nolimit-agent npm supply chain attack →
Npm device-code phishing in a package: what teams need to know?
Explore further
19/08/2026 4:30 pm
Supply chain trust is now an identity control surface: packages that conceal phishing logic inside runtime code are no longer only malware risks. They can become a path into OAuth approval, delegated mailbox access, and downstream impersonation. For IAM teams, that means registry trust and identity governance now overlap, especially where developer tooling can trigger authentication flows on behalf of a user. The practitioner conclusion is simple: dependency review must account for identity abuse potential, not just code safety.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Secrets exposure and immediate abuse are already operationalised by attackers, which is why leaked credential windows should be measured in minutes rather than days.
A question worth separating out:
Q: Who is accountable when delegated mailbox access is abused through a third-party package?
A: Accountability usually spans software supply chain owners, identity platform teams, and the business owner that approved the application or workflow. If device-code access or Graph permissions were not constrained, the identity team owns the control gap. If the package was approved without provenance review, the software governance process also failed.
👉 Read our full editorial: Npm package nolimit-agent turns device-code phishing into supply chain risk
