npm ecosystem supply chain attacks exploit TypeScript maintainer workflows
8/10 HighMultiple sophisticated npm compromises in 2025 (s1ngularity, debug/chalk, Shai-Hulud) exposed systemic weaknesses in TypeScript ecosystem maintainer authentication and CI workflows. The ecosystem requires stricter security practices but lacks standardized protections.
Sources
Collection History
Attackers compromised the popular Nx monorepo build system by publishing malicious npm packages via a GitHub Actions exploit, injecting credential-harvesting malware that stole SSH keys, .env** ** files, wallets, and API tokens. This attack affected over 2,000 repositories.
The npm ecosystem saw a chain of incidents (s1ngularity, debug/chalk, Shai‑Hulud) that exposed systemic weaknesses in maintainer auth and CI workflows. Security responses now emphasize granular tokens, publish-time 2FA, and stricter release policies.