The npm attack that turned provenance attestations into camouflage
Security researchers this week disclosed an npm supply-chain attack affecting more than 400 packages, including projects connected to Keyv and The post The npm attack that turned provenance attestations into camouflage appeared first on The New Stack .
<note>This brief is based solely on the information provided in the <report> block, without adding any outside knowledge or speculation.</note>
In a recent supply-chain attack, malicious npm packages affected over 400 projects, including those related to Keyv and Cacheable. The attackers exploited stolen developer credentials to publish the malicious versions, leveraging trusted workflows and publishing permissions. The attack, which began with Mini Shai-Hulud worm, spread through stolen maintainer credentials and infected developer machines and CI environments.
Once inside, the worm injected malicious preinstall hooks and bumped patch numbers, allowing the malware to run before application tests or security checks. This incident highlights the vulnerability of trusted publishing systems and the potential for malware to carry valid provenance attestations. To mitigate such risks, engineering teams are advised to isolate publishing from dependency installation, restrict automated processes, and keep publishing access away from parts of the pipeline that install dependencies.
Brief written by urgent.news from The New Stack's own syndicated text. Machine-written — it may contain errors, so check the original before relying on it.
