Notifications
Clear all
Topic starter
20/08/2026 5:51 pm
TL;DR: Phishing against maintainers in the September 2025 NPM supply chain attack led to at least 27 compromised packages and billions of weekly downloads at risk, according to ArmorCode’s analysis. The incident shows that software supply chain security now depends as much on identity verification and maintainer trust as it does on code scanning.
NHIMG editorial — based on content published by ArmorCode: Inside the September 2025 NPM Supply Chain Attack
By the numbers:
- 27 packages are now confirmed compromised, mpromised, affecting billions of weekly downloads across the JavaScript ecosystem.
- The injected malware maintained over 280 hardcoded attacker addresses for redundancy.
Questions worth separating out
Q: What fails when a package maintainer account is phished?
A: The failure is publisher trust, not just endpoint security.
Q: Why do account takeover metrics matter to IAM and NHI teams?
A: They show how authentication fails in the real world, especially where credentials are reused, leaked, or abused at scale.
Q: How do security teams know if dependency controls are actually working?
A: Look for whether build systems prevent unauthorised version drift, whether package provenance is checked before install, and whether secret-handling code is isolated from broad application reach.
Practitioner guidance
- Harden maintainer publishing identities Require phishing-resistant MFA, separate administrative accounts, and out-of-band verification for package publishing and token resets.
- Inventory and prioritise exposed dependencies Use SBOM data to map which internal applications consume the affected packages, then rank remediation by internet exposure, transaction paths, and business criticality.
- Validate package provenance before deployment Check signatures, hashes, and publication history for critical dependencies, and block installs when package ownership or release patterns change unexpectedly.
What's in the full article
ArmorCode's full blog covers the operational detail this post intentionally leaves for the source:
- Package-by-package remediation guidance showing which versions must be upgraded and which must be reverted.
- The complete timeline of the compromise, including the malicious domain registration and the progression of package discovery.
- Code-level malware behaviour analysis, including browser API interception and address replacement logic.
- Detailed dependency list and fix mapping for teams that need to validate their own build pipelines.
👉 Read ArmorCode's analysis of the September 2025 NPM supply chain attack →
NPM supply chain compromise: what it means for dependency governance?
Explore further
20/08/2026 6:30 pm
Dependency publishing is now an identity governance problem. The NPM incident shows that package maintainer accounts, publishing tokens, and registry access have the same governance significance as privileged administrative identities. When a maintainer is phished, the attacker inherits trusted publishing rights and can weaponise the dependency graph. That means IAM teams and software supply chain owners need shared lifecycle controls for high-risk publishing identities.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when a malicious package reaches production systems?
A: Accountability usually sits across security, engineering, and platform operations. Engineering controls the dependency choices, security defines the detection and response requirements, and platform teams govern build pipelines and package trust policies. Frameworks such as NIST CSF, NIST 800-53, and MITRE ATT&CK support shared ownership of prevention, detection, and response.
👉 Read our full editorial: NPM supply chain attack exposes dependency trust and maintainer risk
