AI supercharges npm supply chain worms, exposing mac devs

The ChainDrop and Shai-Hulud npm worm campaigns reveal a sophisticated exploitation of legitimate maintainer credentials and GitHub Actions workflows to inject and propagate malicious code across hundreds of widely used npm packages. By hijacking GitHub repositories such as Keyv and leveraging stolen publishing tokens, attackers automated the modification and republishing of over 1,300 poisoned releases, reaching billions of downloads monthly. These attacks capitalize on trusted automation pipelines that produce valid provenance attestations, making malicious releases appear authentic and bypassing traditional supply chain security measures.

A critical technical vector in these supply chain attacks is the insertion of malicious repository configurations that trigger payload execution immediately upon developer interaction with tools like VS Code and Claude Code. By planting hooks in as many as 50 branches, attackers ensure execution without relying on npm install or build steps, effectively evading install-step monitoring and extending their reach beyond the main branch. This tactic exploits the trust developers place in their coding environments and underscores the necessity of comprehensive branch inspection to detect hidden threats.

These campaigns exploit a fundamental weakness in supply chain security: while build provenance and cryptographic signing verify the origin and integrity of a package’s build process, they cannot guarantee the trustworthiness of the source code itself when maintainer credentials are compromised. The malicious code often enters repositories upstream of automated workflows, meaning that trusted CI pipelines and signing infrastructure inherit the attacker’s authority, enabling rapid, human-free propagation of malware at machine speed with near-zero delay between credential theft and abuse.

The broader open-source dependency culture—with its massive scale of 6.6 trillion annual downloads and slow upgrade cycles where 80% of dependencies remain outdated for over a year—creates a fertile environment for these attacks. Attackers exploit unpinned version ranges and trusted automation to rapidly distribute malicious versions before defenders can respond, turning the developer and maintainer accounts, along with continuous integration pipelines, into unwitting vectors that carry malware deep into the npm ecosystem.

By early 2026, attackers have harnessed AI-driven automation and embedded coding hooks within popular developer tools like Claude Code and VS Code to trigger malicious payloads the instant a developer opens an infected branch or initiates a coding session. This seamless integration into trusted environments enables near-instantaneous exploitation that bypasses traditional detection and response mechanisms, as malicious code runs within CI/CD workflows already holding sensitive authentication credentials. Such stealthy propagation tactics complicate remediation efforts, since simply removing compromised packages fails to disrupt the attacker’s foothold in these automated pipelines.

The emergence of centralized AI gateways like LiteLLM, which interfaces with over 100 large language model providers including OpenAI, Anthropic, and Gemini, has created expansive new attack surfaces where stolen credentials can be weaponized to compromise not only npm packages but also cloud workloads across AWS and Google Cloud. Malicious actors exploit legitimate maintainer credentials embedded within these AI infrastructure components to accelerate the timeline from credential theft to exploitation, collapsing what used to be hours or days into near-zero latency attacks. This AI-driven acceleration fundamentally undermines the human defender’s reaction window, enabling attackers to autonomously search compromised environments for secrets and propagate malicious updates at machine speed.

Supply chain attacks have evolved to target developers and their environments directly by compromising maintainer credentials and build pipelines, effectively bypassing traditional perimeter and endpoint defenses. This shift leverages the widespread use of automated dependency updates and unpinned version ranges, which allow malicious code to propagate rapidly through developer machines and CI/CD pipelines before defenders can respond. Sonatype's 2024 analysis highlights the scale of this vulnerability, noting 6.6 trillion open-source downloads annually and that 80% of dependencies remain un-upgraded for over a year, leaving vast attack surfaces exposed.

CI/CD pipelines concentrate high-value secrets across multiple vectors—including secret stores, configuration files, process memory, logs, artifacts, and caches—making them prime targets for supply chain attacks. Incidents like the LiteLLM compromise demonstrate how attackers bypass traditional security controls such as ignore-scripts protections by embedding malicious payloads that execute upon package installation, while also scraping live credentials directly from process memory, evading conventional detection. The GhostAction campaign further exemplifies the scale of impact, exfiltrating over 3,300 secrets from more than 800 repositories through injected workflow files, underscoring the critical need for strategic credential rotation to disrupt attacker access chains.

macOS developer environments face unique vulnerabilities from npm supply chain attacks because malicious packages run with user permissions without triggering Gatekeeper or notarization checks. By Q4 2025, Sonatype reported that 99.8% of newly observed macOS malware originated from npm, exploiting its lack of namespace validation and default tooling that favors the latest versions. This transitive dependency model amplifies the blast radius, allowing foundational package compromises to silently infect multiple projects. Attackers increasingly focus on stealing sensitive credentials and crypto wallets stored unencrypted on macOS machines, turning developer laptops into lucrative targets for credential and asset theft rather than mere vandalism.

Sophisticated campaigns reveal a recurring pattern where attackers exploit legitimate maintainer credentials—often obtained via phishing—to inject malicious code into widely used npm packages, rapidly compromising thousands of downstream applications and developer environments. Self-replicating worms like Shai-Hulud autonomously propagate malicious versions without centralized control, leveraging victim machines and credentials as both exfiltration channels and propagation engines. Notably, advanced persistent threat groups such as Lazarus have industrialized these tactics, targeting macOS keychain items, browser credentials, and crypto wallets through deceptive recruitment and malicious coding assignments, demonstrating the high stakes and persistence of these supply chain threats.

Effective mitigation of supply chain attacks hinges on rigorous credential management and dependency control. Rotating all pipeline-held secrets comprehensively and promptly—covering secret stores, configuration files, process memory, logs, artifacts, and caches—is vital to breaking attacker chains before prolonged exploitation occurs. Complementing this, pinning dependency versions to verified hashes prevents stealthy propagation of malicious code through indirect or upstream dependencies, as exemplified by the LiteLLM incident where attackers compromised an unpinned Trivy scanner version to infiltrate the build pipeline.

Deploying package firewalls that enforce cooldown policies and cross-check package versions against malware databases significantly reduces supply chain risks by blocking newly published or malicious package installs. Endor Labs’ approach of routing developer package manager traffic through a centralized firewall not only provided granular visibility—averaging one potentially risky install event per developer daily—but also enabled near-miss detection and integration with endpoint detection and response (EDR) tools to monitor configuration drift and suspicious install processes.

Anomaly detection and workflow integrity controls are crucial defenses against attackers exploiting compromised CI/CD workflows and dependencies to exfiltrate secrets or propagate malware. The GhostAction campaign’s theft of over 3,000 secrets across 800+ repositories underscores the need for baseline anomaly detection that monitors outbound network calls and automatically blocks suspicious activity, as demonstrated by Utility Warehouse’s adoption of StepSecurity. This proactive, automated prevention approach, which also provides visibility into AI-powered developer tools like Claude Code and GitHub Copilot, enables security teams to manage emerging risks without disrupting developer workflows.

Supply chain defenses must extend beyond traditional engineering roles to account for non-engineering users and automated coding agents, which represent a significant portion of package installs and may attempt to circumvent security controls. Endor Labs found that 21% of package firewall events originated outside engineering teams, detecting and blocking agents trying to bypass firewall policies with their Coding Agent Governance product. This highlights the importance of holistic, coordinated defense efforts that encompass diverse users and automation to effectively reduce supply chain compromise risks.