Notifications
Clear all
Topic starter
01/08/2026 8:57 pm
TL;DR: A two-stage npm supply chain attack let polymarket-stake-math disguise a clean math library before swapping in a 2,255-line infostealer that harvested browser sessions, crypto wallets, Telegram data, and cloud and developer secrets, then shifted delivery to hot-swappable Vercel infrastructure, according to Panther. The pattern shows why install-time review alone is no longer enough when developer endpoints hold both human credentials and non-human identity material.
NHIMG editorial — based on content published by Panther: A Patient Trojan Dropper, polymarket-stake-math Steals Wallet Keys, Browser Sessions, and Telegram from Crypto Developers
Questions worth separating out
Q: What breaks when malicious npm packages are reviewed only at publish time?
A: Publish-time review misses the key deception in staged supply chain attacks: the package can be clean when inspected and malicious only after installation or after a later version update.
Q: Why do developer endpoints create such high identity risk?
A: Developer endpoints often hold browser sessions, API tokens, cloud keys, and wallet material in one place.
Q: How do security teams detect hot-swappable supply chain payloads?
A: Use behavioural detections that look for install-time child processes, temporary extraction paths, file overwrites inside package directories, and unusual egress immediately after dependency installation.
Practitioner guidance
- Monitor install-time process behaviour Flag npm, yarn, or pnpm lifecycle processes that spawn node children, make outbound connections, or rewrite files inside node_modules after installation.
- Treat browser and token stores as governed credentials Inventory developer machines for Chrome, Firefox, wallet, Telegram, and CLI token stores, then include them in credential rotation and incident response playbooks.
- Block secrets from living in local project files Prevent .env, config files, and shell history from containing long-lived credentials, and scan workstation and CI images for AWS, GitHub, npm, and PyPI tokens before and after package installs.
What's in the full report
Panther's full analysis covers the operational detail this post intentionally leaves for the source:
- Line-by-line breakdown of the dropper code and the exact postinstall sequence it uses.
- File and process indicators tied to the Vercel-hosted payload pivot and multipart exfiltration.
- Detection logic examples for npm lifecycle abuse, browser-store access, and wallet-directory harvesting.
- IOC details for the package versions, publisher identities, and payload infrastructure.
👉 Read Panther's analysis of the npm supply chain attack behind polymarket-stake-math →
npm supply chain malware: what developers and IAM teams need now?
Explore further
01/08/2026 9:04 pm
Benign-first staging is now a core supply chain deception pattern. The package starts clean, then changes after trust has already formed, which makes single-scan review structurally weak. This is not just malware hiding in a registry, it is malware exploiting the assumption that publication time and execution time are the same. For IAM programmes, the lesson is that trust decisions around developer tooling need lifecycle monitoring, not one-time approval.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when stolen developer tokens are reused to reach production systems?
A: Accountability is shared across endpoint security, IAM, and secrets governance because the compromise usually begins on a workstation but ends as an access-control failure. Teams should map the incident to identity lifecycle controls, secret storage rules, and privileged access boundaries so ownership is clear before the next compromise.
👉 Read our full editorial: Supply chain malware in npm turns developer tools into credential theft
