September 2025 NPM supply-chain attack compromises popular JavaScript packages
Needed another two minutes in the oven. A half-baked bagel.
Summary
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attacker compromised maintainer accounts through credential stuffing and phishing, then published malicious updated versions of widely-used packages. The incident sparked renewed global discussions about dependency trust, open-source governance, and structural vulnerabilities in modern software development workflows.
Key quotes
· 3 pulledThe September 2025 NPM Chain Attack
the JavaScript ecosystem faced one of its most disruptive security events to date: a coordinated software supply-chain attack targeting multiple popular NPM packages
The incident reignited global conversations about dependency trust, open-source governance, and the structural vulnerabilities in today's interconnected software development workflows
You might also wanna read
NPM supply chain attack compromises popular packages, posing widespread security risk
A significant supply chain attack on the NPM package ecosystem compromised several popular packages, potentially allowing malicious code to
xeiaso.net·8mo ago
317 npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack
A major npm supply chain attack occurred on May 19, 2026, when the npm account of maintainer "atool" was compromised. The attacker published
safedep.io·12d ago
Major NPM Supply Chain Attack: @ctrl/tinycolor and 40+ Packages Compromised with Self-Propagating Malware
A sophisticated supply chain attack has compromised the popular @ctrl/tinycolor NPM package (with over 2 million weekly downloads) along wit
stepsecurity.io·8mo ago
Major NPM Supply Chain Attack: Over 1,000 Packages Infected via Fake Bun Runtime
A major cybersecurity incident occurred where over 1,000 NPM packages and 27,000+ GitHub repositories were infected within hours via a fake
helixguard.ai·6mo ago
NPM Package Author "qix" Compromised in Ongoing Supply Chain Phishing Attack
This article discusses the ongoing issue of phishing attacks targeting NPM package authors, specifically focusing on a compromised author na
github.com·8mo ago
JavaScript Community Faces Reckoning After Major Supply-Chain Attack
The article discusses the aftermath of the largest supply-chain attack in JavaScript history, suggesting this could be a pivotal moment for
drewdevault.com·8mo ago