npm should-i-install Malicious npm packages: Anatomy, Detection gaps and AI's role

DIPTENDU KAR, DERIAN STENGLEIN

whoarewe

Agenda

• Brief history of npm malwares.�
• Why NPM.�
• Attack vectors: How attackers get in.�
• The Payload tricks: How malwares are delivered.�
• Can AI help in malware detection and deny-by-default.�
• Possible Solutions.

The Growing Problem

• 2023
• > 5000 malicious packages taken down by npm
• February saw >15,000 spam packages published to npm across two days
• Npm statistics showed >2.5 million live packages and >184 billion downloads/month by the end of 2023
• 2024
• > 512,000 malicious packages out of estimated 4.8 million packages
• Notable attacks:  LUMMA malware (PyPi), XZ Utils package backdoor

​

​

https://socket.dev/blog/2023-npm-retrospective

https://www.sonatype.com/state-of-the-software-supply-chain/introduction

Aug 24 – Sep 24

​

• NX s1ngularity attack – August 26, 2025
• More than 2000 secrets leaked.
• 16 million+ weekly downloads (combined 8 packages)

​

• Chalk/Debug compromise – September 8, 2025
• 2 billion weekly downloads (combined 18 packages)
• DuckDB compromise – September 9, 2025
• 386K+ weekly downloads (combined 4 packages), continuation of above.
• @ctrl/tinycolor compromised: Shai-Hulud worm – September  15, 2025
• Total 180+ packages, @ctrl/tinycolor 2.2M+ weekly downloads
• First self-replicating npm worm

​

Aug 24 – Sep 24

• Talk submitted to BSides CT – August 24, 2025
• NX s1ngularity attack – August 26, 2025
• More than 2000 secrets leaked.
• 16 million+ weekly downloads (combined 8 packages)
• Talk tentatively accepted – September 5, 2025
• Chalk/Debug compromise – September 8, 2025
• 2 billion weekly downloads (combined 18 packages)
• DuckDB compromise – September 9, 2025
• 386K+ weekly downloads (combined 4 packages), continuation of above.
• @ctrl/tinycolor compromised: Shai-Hulud worm – September  15, 2025
• Total 180+ packages, @ctrl/tinycolor 2.2M+ weekly downloads
• First self-replicating npm worm

​

This is just a coincidence – I promise I did not do all this just to get this talk accepted.

Why npm?

• Unlimited packages
• JS does not have a very good standard library – large amounts of widely used “single function” libraries show up
• Consequently, npm has a large dependency graph
• 10 direct deps -> 683 transitive deps
• Very easy to publish to npm, no manual review, no sandbox, no questions asked
• npm runs everywhere - frontend, backend, CI/CD, AI CLI, WEB3, even desktop apps → credentials galore

​

​

​

https://github.blog/security/supply-chain-security/best-practices-to-keep-your-projects-secure-on-github/

is-windows

Attack Vectors: How attackers get in

• Randomly named malicious package
• Typosquatting
• Dependency confusion
• Maintainer account takeover

Random named malicious package

• Users would not normally download
• Stats like stars, homepage, dependencies, etc. are low suggesting very unpopular package
• Every new package starts like this, grows overtime
• Or, someone may inflate the number of packages to earn reputation and earn tea rewards

Typosquatting

Typosquatting

• Lodash - legitimate�
• lodah
• lodahs
• oldash
• lodahs
• lodqsh
• lodashh
• lodassh
• lodarshe
• lodash.js

The bright side

• npm community reports malware – all examples of typos have been replaced with security holdings so you cannot download malicious packages
• still don’t recommend making typos or downloading malware (copy-pasting helps)

​

​

Dependency confusion

• https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
• The attacker uses specific package names of internal packages of a target and publishes a malicious package on an external public repository with the exact name
• The attacker then assigns a very high version number to this published package
• Most default package managers prefer downloading the external malicious package because of its high version number rather than downloading a low version from the legitimate internal repository
• Impact is likely limited to singular organizations

​

Dependency confusion

Maintainer account takeover

• Compromise legitimate maintainer accounts (social-engineering mainly)
• Release a new version with a malware
• Inherits all stats, downloads, dependencies and hence TRUST
• Chalk/Debug (phishing), NX (GitHub workflow injection), eslint-config-prettier (July 18, 2025)
• Highest impact

Phishing mail - chalk/debug

https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised

Maintainer account takeover

The Payload Tricks: How malware gets delivered

• Install-Time Scripts
• Preinstall/postinstall hooks execute automatically
• Can run code packaged within the library or download external payloads and execute them
• Directly via index.js / the start file as specified by "main" in package.json
• Payload types / Defense evasion strategies
• Readable malicious code -> No defense evasion
• Minified code
• Obfuscated code
• Bundled binary and execute the binary -> possibly max defense evasion

Readable malicious code - nx

Readable malicious code - nx

• Collects sensitive info
• Environment variables (process.env), Hostname and OS details, Platform information
• Cryptocurrency Wallets like MetaMask keystores, Electrum wallets, Ledger and Trezor data Exodus, Phantom, and Solflare wallets Generic keystore files (UTC--*, keystore.json, *.key)
• Development Credentials like GitHub authentication tokens via gh auth token, npm registry tokens from ~/.npmrc, SSH private keys (id_rsa), Environment files (.env)
• Exfiltration
• Creates a public GitHub repository named s1ngularity-repository using stolen GitHub tokens.
• Triple-base64 encodes all collected data, uploads the encoded data to results.b64 in the newly created repository
• Makes the repository publicly accessible, exposing sensitive data
• AI CLI Exploitation
• Checks for gemini, claude, q and forces the AI tools to recursively scan the filesystem and write discovered sensitive file paths to /tmp/inventory.txt

​

​

​

https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware

Minified code - @ctrl/tinycolor (worm)

Minified code - @ctrl/tinycolor (worm)

• Collects sensitive info
• Downloads and executes TruffleHog, a legitimate secret scanner.
• GitHub personal access tokens, AWS access keys (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), Google Cloud Platform service credentials, Azure credentials, Cloud metadata endpoints, NPM authentication tokens
• Persistence
• Injecting a GitHub Actions workflow file (.github/workflows/shai-hulud-workflow.yml) via a base64-encoded bash script.
• Exfiltration
• This workflow triggers on push events and exfiltrates to a hardcoded webhook.
• Worm
• NPM registry API to fetch up to 20 packages owned by the maintainer, then force-publishes patches to these packages adding the same bundle.js

​

​

​

https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised

Obfuscated code - debug

No pre install or post install, obfuscated code in index.js

Obfuscated code - debug

Obfuscated code - debug

• Cryptocurrency stealer.
• Silently embeds a browser-side interceptor into frontend bundles.
• Activates when a user visits website.
• Hooks core functions like fetch, XMLHttpRequest, and wallet APIs (window.ethereum, Solana, etc.).
•  Scans responses and transaction payloads for blockchain addresses (ETH, BTC, SOL, TRX, LTC, BCH).
• Hijacks transactions before they’re signed. Alters transaction parameters (e.g., recipients, approvals, allowances). Even if the UI looks correct, the signed transaction routes funds to the attacker. Code contains hardcoded attacker's wallet address.
• Around $50 worth of cryptocurrency stolen.

​

​

​

Bundled Binary – napi-postinstall

Bundled Binary – napi-postinstall

Automation gone wrong

Window of Opportunity/Exposure

• Possible window of exposure
• Vendors and independent researcher analysis starts
• Dependabot or similar

• No exposure
• Vendors and independent researcher analysis completed
• Dependabot or similar - don’t affect
• Residual risk (for affected)

• No exposure
• Everyone has data now. OSV, GHSA, Blogposts, etc.
• Dependabot or similar - nope

EXPOSURE RISK

https://www.kaspersky.com/blog/nx-build-s1ngularity-supply-chain-attack/54223/

Role of AI and deny-by-default

Readable malicious code - nx

• Can AI help – Yes with high degree of accuracy.
• Easiest just send the content.
• Deny-by-default – N/A, we already know what the code does.

Minified Code - worm

• Can AI help – maybe but with less accuracy than readable
• In this case – claude said this is a legit minified code.
• Deny-by-default – No, legitimate packages contain minified code as well.

Obfuscated Code - debug

• Can AI help – maybe
• In this case – claude correctly identified from search patterns.
• Deny-by-default – Yes, Legit packages DON’T usually contain obfuscated code.

Binary – napi-postinstall

• Can AI help? maybe. Test case not run. Static analysis on binaries.
• Reverse engineering, decompilation, work with symbols
• Depends on binary type, elf, dll, exe etc.
• Symbols stripped or not.
• Binaries can be obfuscated as well.
• Not as simple as – tell me what this does.
• Deny-by-default: No. Legit packages like @anthropic-ai/claude-code uses binary to install.

Potential issues with full AI analysis

• Size of file greater than context window
• Readable code can be segregated by file or even by each function.
• False positives & negatives. Non-deterministic.
• Adversarial code specifically designed to avoid static analysis.
• Bypass using prompt injection techniques.
• Human-in-the-loop is possible and may be necessary but that requires more time (window).
•  https://checkmarx.com/zero-post/bypassing-claude-code-how-easy-is-it-to-trick-an-ai-security-reviewer/

Possible solutions

• Use tools provided by vendors like Socket, Aikido, Checkmarx, etc.
• May be appropriate for orgs, but for developers (individual – small sized)?
• Install any package in a sandbox first.
• Time and resource and expertise.
• Avoid FOMO of latest and greatest version.
• Pin package versions to avoid auto updates.
• Use “--ignore-script” or similar.
• Short lived, granular token. (already enforced by npm now).
• Do not merge dependabot PR asap. Hold up … wait a minute…or couple hours
• Let NPM run these detection tools on their end before publishing a package (personal opinion).

Derian Diptendu

QUESTIONS?

THANK YOU

LinkedIn

LinkedIn