The Mac You Trust Runs the Code You Never See
Malicious npm packages bypass macOS defenses entirely. How supply chain attacks hit Mac developers, orgs, and everyday users — and why you're exposed.
Most Mac users are unaware of a hidden threat that can compromise their machines and expose sensitive information. While many people think malware comes from downloading shady apps or ignoring Gatekeeper warnings, a new type of attack is emerging. This type of attack does not involve a file you download or a Gatekeeper prompt. Instead, it arrives as a line in a dependency tree, often without any human intervention. When you run npm install, this malicious code runs with your permissions.
Supply chain compromise is becoming the default access strategy for attackers in 2026, according to Moonlock's 2026 macOS malware trends report. In 2025 alone, Sonatype identified over 454,600 new malicious packages across major registries, with the number of detected malware rising by 188% year over year. Of these, 99.8% originated from npm, a JavaScript registry used by nearly every modern web and desktop application.
This pushed data exfiltration to the dominant category, with 56% of malware in Q1 2025 focused on stealing tokens, keys, credentials, and wallet material.
Three structural facts make the JavaScript supply chain unusually dangerous on macOS specifically:
1. Macs are developer machines, with a population that heavily uses npm, making them prime targets for attackers.
2. The goal of attacks has shifted from vandalism to theft, with malware now designed to steal valuable assets like SSH keys, cloud credentials, browser sessions, and crypto wallets.
3. npm install runs arbitrary code, and Apple's defenses never see it. A package can include a postinstall script that runs automatically during installation, bypassing Gatekeeper prompts and other Apple app-trust mechanisms.
The threat is particularly insidious because the malware does not rely on human interaction. A modern app can pull in dozens of direct dependencies, which in turn pull in hundreds of indirect ones. If foundational utilities are compromised, every project that depends on them inherits the compromise. The recent @solana/web3.js attack in December 2024 is a prime example.
An attacker gained publish access through social engineering and pushed malicious versions of the library that captured private keys and sent them to a hardcoded wallet address. This incident, which occurred in just five hours, resulted in stolen SOL and other tokens, affecting not only developers but also end users of apps that handled private keys.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
