NPM Attacks: The Latest Threat to Software Supply Chain Security
Hi everyone. This is Jon. In the world of AI and technology, new tools and services are being developed every day, but the security of the infrastructure that supports them is crucial. Today, I'd like to discuss a supply chain attack targeting NPM (Node Package Manager), a JavaScript package management tool. NPM is a system that allows developers to share and reuse code components (packages), and is used in apps and websites around the world. Recently, a large-scale attack occurred in September 2025, compromising many packages, and this has been making headlines. This attack exploits the software supply chain (the process from development to distribution), so even beginners should be aware of it. Let's start with an overview to make it easier to understand.
Recommended for those who want to start automating with no coding!
With Make.com (formerly Integromat)...
📌 Integrate major tools like email, Slack, Google Sheets, and Notion all at once
📌 Automate complex tasks with just drag and drop
📌 A free plan is also available, so you can try it out for yourself.
If you're interested, here's the details:
What is Make.com (formerly Integromat)? How to Use It, Pricing, Reviews, and Latest Information [2025 Edition]
Understanding the basics of supply chain attacks
A supply chain attack is a cyberattack that targets the software development and distribution process. For example, malware (malicious programs) is inserted into code downloaded from repositories (package storage) like NPM, infecting users' systems. This can lead to trusted packages being misused, potentially affecting millions of apps and services. For beginners, it's like poisoning a food supply chain. This 2025 attack was notable for its use of self-replicating malware named "Shai-Hulud," which allowed the infection to spread rapidly.
AI-powered tools can be helpful when learning about these technical topics. For example:AI tool called GammaYou can quickly create documents and slides using this tool, which is also useful for creating security-related materials. If you're interested, be sure to check it out.
Details of the September 2025 NPM Mass Attack
In September 2025, the NPM ecosystem witnessed one of the largest supply chain attacks in history. Let's start with a timeline. The attack began around September 8th, when trusted developer accounts were compromised via phishing (a fraudulent email or website attack that steals information). This resulted in the compromise of popular packages like chalk, debug, and strip-ansi (some of which are downloaded over 2 billion times a week) and the injection of malware.
On September 10th, Palo Alto Networks published a blog post publicly announcing the attack, noting that hundreds of millions of downloads were at risk. On September 16th, OX Security published details of the "Shai-Hulud" malware. Versions 4.1.1 and 4.1.2 of packages such as @ctrl/tinycolor contained malicious code designed to steal developer credentials (such as passwords). The malware was self-replicating, exhibiting "worm-like" behavior, allowing it to infect additional packages from infected systems.
Furthermore, on September 17, Sonatype and the Cyber Security Agency of Singapore sounded the alarm, announcing that more than 180 packages had been affected. Unit42 (Palo Alto's research team) also released updated information on the same day, stating that hundreds of packages had been affected. Around September 18, SC Media reported in detail that malware had been injected via the bundle.js file.
The news spread rapidly on X (formerly Twitter), with security experts and developers calling it a risk to the entire JavaScript ecosystem. For example, a September 8th post warning that "more than 200 million downloads are at risk" garnered tens of thousands of views, and a post by Crypto Rover also pointed out the risk to cryptocurrency wallets. While these posts are indicators of the impact of the attack in real time, it's important to verify the facts based on official announcements.
Key characteristics of the attack
I'll summarize the key points of this attack in bullet points, so even beginners should be able to get the big picture.
- The number of target packages: Starting with 18, it has expanded through self-replication to over 180, and now to a maximum of 477. This includes frameworks such as Angular, React Native, and Cordova.
- How malware works: Malicious code is executed upon installation and exploits tools like TruffleHog to steal credentials, which are then used to publish and infect new packages.
- Impact rangeWith billions of downloads per week, mobile app backends, CI/CD pipelines (automated development processes), and even cryptocurrency-related tools could be at risk.
- CVE Number: Registered as CVE-2025-23166, this vulnerability raises security concerns for Node.js.
This information comes from trusted sources, including Palo Alto Networks, Sonatype, and OX Security. The attack was updated on September 19th and is reported to still be ongoing.
Measures to strengthen the security of the software supply chain
Let's consider what developers and users can do to protect against such attacks. Supply chain security is not just a matter of tools; reviewing the entire process is key. An InfoWorld article (published around September 20, 2025) points out that process improvements and reviewing funding sources are effective.
Basic countermeasures
- Package VerificationBefore downloading from NPM, check the version and official security advisories. Use npm audit (a vulnerability scanning tool) as a tool.
- Implementing multi-factor authentication: Enable 2FA (two-factor authentication) to prevent account hijacking. Avoid opening suspicious emails to protect yourself from phishing.
- Minimizing Dependencies: Reduce unnecessary packages and use only trustworthy ones. Funding open source also helps maintainers improve security.
- Keep track of the latest information: Regularly check the Sonatype and Palo Alto blogs, as well as the official npm security page.
As a prediction for 2025, PYMNTS.com (around September 22nd) reports that third-party supply chain attacks will increase. An article in LinuxConfig also highlights vulnerabilities in the Node.js ecosystem and recommends the use of automated tools as mitigation strategies.
Summary: Keeping your technology safe
The NPM attack this time has highlighted the vulnerabilities in the software supply chain. As users, we should not forget the basics of security while using convenient tools. We should also acquire this knowledge so that we can enjoy AI and technology.
Looking for an AI tool to help you with your documentation?Gamma's latest newsCheck it out and study efficiently.
A word from Jon: This attack took advantage of the strengths of open source, but it's encouraging that it was detected quickly thanks to the cooperation of the community. Everyone should start with small measures and live a safe digital life. See you in the next article.
Reference sources
- Palo Alto Networks Blog: https://www.paloaltonetworks.com/blog/cloud-security/npm-supply-chain-attack/ (2025-09-10)
- OX Security: https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hit-in-major-supply-chain-attack/ (2025-09-16)
- Sonatype Blog: https://www.sonatype.com/blog/ongoing-npm-software-supply-chain-attack-exposes-new-risks (2025-09-17)
- Cyber Security Agency of Singapore: https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2025-019 (2025-09-17)
- Unit42: https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ (2025-09-17)
- PYMNTS.com: https://www.pymnts.com/news/security-and-risk/2025/hacks-third-party-supply-chains-expected-rise-2025 (recent article)
- WebProNews: https://www.webpronews.com/shai-hulud-malware-hijacks-180-npm-packages-in-supply-chain-attack/ (Recent Article)
- InfoWorld: https://www.infoworld.com/article/4060306/npm-attacks-and-the-security-of-software-supply-chains.html (around 2025-09-20)
- LinuxConfig: https://linuxconfig.org/unprecedented-npm-supply-chain-attack-heightens-node-js-security-concerns-in-2025 (around 2025-09-16)
- Cybersecurity News: https://cybersecuritynews.com/shai-hulud-npm-supply-chain-attack/ (around 2025-09-18)
- Related posts from X (formerly Twitter) (e.g. StarPlatinum, Crypto Rover, Florian Roth, etc., 2025-09-08 to 09-20)