Notifications
Clear all
Topic starter
20/08/2026 6:04 pm
TL;DR: A compromised @velora-dex/sdk 9.4.1 npm tarball executed on import, not through lifecycle scripts, so standard install-time defences would not block it and macOS developer environments could still be exposed, according to Corgea. The case shows why dependency reachability, artifact integrity, and secret rotation must be treated as one control plane, not separate tasks.
NHIMG editorial — based on content published by Corgea covering the @velora-dex/sdk compromise: critical CVE analysis of the npm supply chain attack and macOS import-time execution
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when malicious npm packages execute on import instead of install?
A: Install-time controls often miss import-time payloads because the malicious code lives in the published bundle and runs when the module loads.
Q: Why do compromised npm packages create supply chain risk beyond developer machines?
A: Because modern pipelines execute dependencies in build runners, test environments, containers, and production services.
Q: How do security teams know whether a package trust issue has become an identity incident?
A: It becomes an identity incident when the affected host or pipeline can reach reusable credentials, publishing tokens, or privileged service accounts.
Practitioner guidance
- Audit import-reachable dependencies Scan manifests, lockfiles, and application entrypoints for packages that execute at import time, then prioritise any dependency with prebuilt dist files or unusual post-install behaviour.
- Compare source, tarball, and build output Verify that the published registry artifact matches the repository and the expected build output before approving a package for production use.
- Treat developer macOS systems as credential endpoints After confirmed import-time compromise, image the host as a credential-bearing system, remove LaunchAgents persistence, and rotate GitHub, npm, cloud, and SSH credentials from a known-clean device.
What's in the full analysis
Corgea's full report covers the operational detail this post intentionally leaves for the source:
- Exact package diff and package.json changes that distinguish the malicious tarball from the clean repository
- Command-and-control and persistence indicators that help responders validate host compromise on macOS
- Step-by-step detection queries for npm lockfiles, caches, and LaunchAgent artifacts
- Remediation sequencing for rotating tokens, SSH keys, and publishing credentials after compromise
👉 Read Corgea's analysis of the @velora-dex/sdk npm supply chain compromise →
npm import-time execution: what crypto app teams need to change?
Explore further
20/08/2026 6:39 pm
Import-time execution is a distinct supply chain failure mode: lifecycle-script blocking is not sufficient when malicious code sits in the module entrypoint. That changes the defensive baseline for npm consumers, especially teams that assume install-time scanning captures the full risk surface. The practical conclusion is that package governance must cover runtime import behaviour, not only installation events.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own response when a build tool compromise exposes credentials?
A: Ownership should sit with IAM, platform engineering, and security operations together, because the issue spans identity, build infrastructure, and downstream cloud access. The right response is cross-functional containment, not a tooling-only patch.
👉 Read our full editorial: npm package import execution exposes a crypto SDK supply chain gap
