Notifications
Clear all
Topic starter
11/06/2026 11:46 pm
TL;DR: A malware campaign targeting more than 50 npm packages used injected scripts to republish packages, steal developer secrets such as GitHub, npm, and cloud credentials, and exfiltrate data to a public repository, according to Orca Security. Package compromise now turns routine dependency installs into secret-harvesting events that identity and security teams must treat as credential exposure, not just code tampering.
NHIMG editorial — based on content published by Orca Security: LLMjacking style supply chain attack analysis of npm package compromise and secret theft
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when a malicious npm package can read developer secrets during install?
A: The main failure is that package execution inherits identity context it should never need.
Q: Why do npm supply chain attacks create such a large IAM risk?
A: Because npm, GitHub, and cloud credentials often coexist in the same developer and build environments.
Q: How do security teams know if package compromise has become a secret exposure event?
A: They look for install-time script execution, unexpected package republishing, workflow files added to repositories, and any evidence that credentials were present in the affected environment.
Practitioner guidance
- Inventory every dependency and transitive package Maintain an up-to-date software bill of materials and know which versions are installed in CI, developer workstations, and production build images.
- Separate package publishing from secret-bearing workflows Remove npm tokens, GitHub tokens, and cloud keys from environments that only need to build or test.
- Rotate exposed secrets as a containment step, not a cleanup task Assume any token or key accessible during the infected install may have been harvested, then revoke and replace it immediately.
What's in the full analysis
Orca Security's full research covers the operational detail this post intentionally leaves for the source:
- The package-by-package infection list, including versions and maintainer scope, for teams validating exposure.
- The exact malicious file and workflow artefacts used for persistence and exfiltration in affected repositories.
- The concrete containment commands and cleanup sequence Orca Security recommends for infected environments.
- The platform-specific guidance on finding exposed secrets and suspicious cloud activity after dependency compromise.
👉 Read Orca Security's analysis of the Shai-Hulud npm supply chain attack →
npm supply chain attacks: what identity teams need to act on?
Explore further
12/06/2026 8:36 am
Package compromise has become an identity event, not just a software integrity problem. The important detail in this campaign is not only that packages were modified, but that the attacker used them to collect reusable credentials from developer and cloud environments. That collapses the boundary between software supply chain security and IAM governance, because the stolen artefacts are secrets, tokens, and keys. Practitioners should read this as an access-control failure with a code-distribution wrapper.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own containment when a dependency attack exposes cloud and repository credentials?
A: Containment should be joint ownership between application security, IAM, cloud security, and platform engineering. The package owner can remove the malware, but only identity owners can revoke tokens, rotate keys, invalidate sessions, and review access paths that the stolen secrets may have opened.
👉 Read our full editorial: Shai-Hulud shows how npm supply chain attacks harvest secrets
