NPM Supply Chain Attack: Active Worm Stealing Tokens, SSH Keys, and Credentials

🚨 Emergency DevSec Station update.

There’s an active npm supply chain attack happening right now.

Malicious npm packages are running install scripts that quietly steal:
 • SSH keys
 • AWS credentials
 • GitHub tokens
 • Browser passwords
 • Crypto wallets

From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm across the npm ecosystem.

This is not theoretical. It’s already in the wild.

👉 Immediate fix:
 Run
 npm config set ignore-scripts true

This disables install scripts and blocks the main attack path.

If you work in JavaScript, Node.js, DevSecOps, or application security, take action now and tell your team.

Watch the full 2 minute breakdown and share this with anyone who installs npm packages.

#npmSecurity #SupplyChainAttack #DevSecOps #AppSec #JavaScriptSecurity #CyberSecurityAlert

Follow Tanya:

• https://shehackspurple.ca
• https://news.letter.shehackspurple.ca
• https://youtube.com/@shehackspurple
• https://linkedin.com/in/tanya-janca
• https://tanyajanca.com