176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
By
Sonatype Security Research Team
Baker's choice. Dense with flavour, light on filler.
Summary
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers published packages with version 99.99.99 to exploit npm's package resolution, targeting internal/private package names used by organizations. The campaign used install-time scripts to steal credentials and compromise developer and CI/CD environments, highlighting supply chain security risks in the JavaScript ecosystem.
Key quotes
· 3 pulledThe versioning strategy was not subtle, and likely was not intended to be.
This is a dependency confusion trick designed to win package resolution races against internal or private packages.
If a customer's SDLC is not set up to defend against it, npm may prefer
You might also wanna read
NPM Vulnerability Allows 126 Malicious Packages to Be Downloaded 86,000+ Times
Security researchers have discovered a major vulnerability in NPM (Node Package Manager) that allows attackers to distribute malicious packa
arstechnica.com·7mo ago
317 npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack
A major npm supply chain attack occurred on May 19, 2026, when the npm account of maintainer "atool" was compromised. The attacker published
safedep.io·13d ago
NPM supply chain attack compromises popular packages, posing widespread security risk
A significant supply chain attack on the NPM package ecosystem compromised several popular packages, potentially allowing malicious code to
xeiaso.net·8mo ago
Major NPM Supply Chain Attack: @ctrl/tinycolor and 40+ Packages Compromised with Self-Propagating Malware
A sophisticated supply chain attack has compromised the popular @ctrl/tinycolor NPM package (with over 2 million weekly downloads) along wit
stepsecurity.io·8mo ago
Security Alert: Malicious Nx Packages Published to npm Containing Credential-Stealing Code
Malicious versions of the Nx package and several supporting plugins were published to npm, containing code that scans file systems, collects
github.com·9mo ago
Major NPM Supply Chain Attack: Over 1,000 Packages Infected via Fake Bun Runtime
A major cybersecurity incident occurred where over 1,000 NPM packages and 27,000+ GitHub repositories were infected within hours via a fake
helixguard.ai·6mo ago