Major NPM Supply Chain Attack: @ctrl/tinycolor and 40+ Packages Compromised with Self-Propagating Malware
By
jamesberthoty
Front-window bakery material. Catches the eye, delivers the goods.
Summary
A sophisticated supply chain attack has compromised the popular @ctrl/tinycolor NPM package (with over 2 million weekly downloads) along with 40+ other packages. The malware features self-propagating capabilities that automatically infect downstream packages, harvests cloud credentials (AWS/GCP/Azure) using TruffleHog, and establishes persistence through GitHub Actions backdoors. This represents a major escalation in NPM ecosystem threats, with the compromised versions being removed from npm after discovery by security researcher @franky47.
Key quotes
· 5 pulledThe NPM ecosystem is facing another critical supply chain attack
The malware includes a self-propagating mechanism that automatically infects downstream packages, creating a cascading compromise across the ecosystem
This attack demonstrates a concerning evolution in supply chain threats
The malware harvests AWS/GCP/Azure credentials using TruffleHog, and establishes persistence through GitHub Actions backdoors
The compromised versions have been removed from npm
You might also wanna read
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers publi
sonatype.com·2d ago
Microsoft detects 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A threat actor using the alias vpmdhaj published 14 malicious npm packages within four hours, impersonating legitimate OpenSearch, Elasticse
theregister.com·1d ago
npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads
An npm package called "mouse5212-super-formatter" targeting Claude users acted as information-stealing malware, reaching 676 downloads befor
theregister.com·1d ago