Post-mortem Analysis of @ctrl/tinycolor npm Supply Chain Attack via GitHub Actions
By
STRiDEX
If you only eat one bagel today, this is the bagel.
Summary
A detailed post-mortem analysis of a supply chain attack on the @ctrl/tinycolor npm package. The attack occurred when a malicious GitHub Actions workflow was pushed to a shared repository, allowing the attacker to exfiltrate an npm token with broad publishing rights. This token was then used to publish malicious versions of 20 packages. The author clarifies that their GitHub account and repository were not directly compromised, no phishing was involved, and no malicious packages were installed on their machine. The article serves as a security lesson about the vulnerabilities in shared repository access and GitHub Actions permissions.
Key quotes
· 5 pulledA malicious GitHub Actions workflow was pushed to a shared repo and exfiltrated a npm token with broad publish rights
The attacker then used that token to publish malicious versions of 20 packages, including @ctrl/tinycolor
My GitHub account, the @ctrl/tinycolor repository were not directly compromised
There was no pull request involved because a repo admin does not need a pull request to add new github actions
Lessons learned from becoming the unexpected face of a npm supply-chain attack
You might also wanna read
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
AWS well-architected framework best practices for software supply chain security
This article discusses software supply chain security best practices in the context of recent npm Registry attacks (Shai-Hulud, Chalk/Debug,
aws.amazon.com·4d ago
AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator
A malicious npm package named mouse5212-super-formatter, identified by OX Security, was caught leaking its own hardcoded GitHub token. This
infosecurity-magazine.com·1d ago
176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers publi
sonatype.com·2d ago