AI-powered npm attacks expose deep flaws in supply chain security

The AsyncAPI supply chain attack starkly illustrates the dangers of misconfigured GitHub Actions workflows, particularly the unsafe use of the pull_request_target event which executes untrusted pull request code in the privileged context of the base repository. This misconfiguration allowed attackers to exfiltrate highly privileged Personal Access Tokens (PATs) by embedding obfuscated JavaScript that scanned the CI environment for secrets, ultimately enabling unauthorized pushes and automated publishing of malicious npm packages under the @asyncapi namespace. The incident underscores how a single overlooked workflow setting can compromise an entire CI/CD pipeline, as seen when the vulnerable asyncapi/generator repository was exploited within minutes to hijack packages with millions of weekly downloads. (Insights [1], [2], [6], [11], [13])

A particularly insidious aspect of this campaign was the use of import-time code execution, where malicious payloads triggered immediately upon module import rather than during installation. This technique bypassed common mitigations like npm install --ignore-scripts and evaded many static and behavioral detection tools integrated into CI/CD workflows. By spawning detached child processes that fetched additional malware stages from decentralized IPFS networks, the attackers implemented a sophisticated multi-stage infection chain that unfolded seamlessly within trusted build and test environments. This shift from install-time hooks to import-time execution represents a significant evolution in supply chain attack tactics, complicating detection and response efforts. (Insights [3], [8], [10], [16])

The attackers further exploited GitHub Actions’ trusted publishing mechanisms, abusing OpenID Connect (OIDC) workflows to release provenance-signed malicious npm packages that appeared cryptographically legitimate. By leveraging automated release workflows such as release-with-changesets.yml, the compromised packages were published under the automated identity npm-oidc-no-reply@github.com, making them indistinguishable from authentic releases at a cryptographic level. This abuse of CI/CD trust models highlights a critical blind spot in supply chain security, where provenance signing—intended as a safeguard—can be subverted to lend credibility to malware, thereby undermining the integrity of software supply chains. (Insights [7], [9], [14], [15])

Despite awareness of the vulnerability, remediation efforts lagged dangerously behind, as a proposed fix to isolate secret access from untrusted code in the AsyncAPI workflows remained unmerged for 58 days before the attack struck. This delay exemplifies the risks posed by slow patch cycles in CI/CD security, where even well-understood misconfigurations can be exploited with devastating speed and scale. The incident serves as a clarion call for organizations to rigorously audit GitHub Actions configurations, enforce least-privilege access controls for tokens and secrets, and avoid unsafe patterns like pull_request_target triggers on untrusted code to harden their CI/CD pipelines against evolving threats. (Insights [5], [17])

By mid-2026, CrowdStrike revealed the sophisticated SANDWORM_MODE malware campaign that hijacks AI coding assistants such as Claude Desktop, Cursor, Visual Studio Code, and Windsurf to stealthily steal developer secrets. This malware integrates deeply into AI-augmented development workflows by deploying rogue MCP servers that masquerade as trusted providers, instructing AI tools to exfiltrate sensitive credentials while blending seamlessly into normal engineering activities to evade detection.

SANDWORM_MODE employs advanced evasion techniques including environment fingerprinting and delayed execution, acting immediately within CI environments but postponing malicious activity on developer workstations by up to 96 hours. This temporal and contextual differentiation complicates detection by scattering malicious telemetry across separate windows, effectively masking its presence within legitimate AI-driven workflows.

Leveraging stolen credentials such as npm tokens, GitHub API tokens, and SSH keys, the malware propagates through multiple vectors within AI development ecosystems—republishing infected packages, injecting dependencies, committing unauthorized changes, and establishing persistence via malicious Git hooks. These actions mimic legitimate AI assistant behaviors, making deterministic detection challenging as the malware’s destructive routines resemble secure cleanup operations.

This campaign exemplifies a paradigm shift in supply chain risk where attackers exploit inherent trust relationships inside AI-assisted development workflows, effectively 'living off the AI toolchain.' By harvesting API keys for nine different AI model providers and abusing AI tool interfaces for secret exfiltration, SANDWORM_MODE exposes novel attack surfaces beyond traditional code repositories, underscoring the urgent need to rethink security in AI-driven software supply chains.

The Miasma malware campaign exemplifies a highly sophisticated multi-stage botnet attack that infiltrates trusted npm packages such as those under the @asyncapi namespace, leveraging compromised GitHub Actions workflows to deliver payloads across macOS, Linux, and Windows environments. By executing malicious code at module import time rather than during installation, Miasma evades conventional detection methods, while its architecture employs encrypted loaders and decentralized command-and-control channels via IPFS, Nostr, Ethereum, and BitTorrent DHT, enabling resilient persistence and credential theft. This campaign's use of legitimate SLSA provenance attestations, earned through hijacked CI/CD pipelines, underscores the evolving challenge of defending supply chains even when cryptographic signatures appear valid.

The Shai-Hulud worm represents a paradigm shift in npm supply chain attacks by autonomously stealing developer credentials and cloud infrastructure secrets to propagate itself through npm packages like @bitwarden/cli, injecting malicious code that triggers cascading infections affecting hundreds of packages and corporate scopes including Deliveroo and Qlik. Its operational security is notable—avoiding Russian hosts and encrypting exfiltrated data with asymmetric AES-256-GCM—while abusing GitHub as a covert exfiltration platform by creating public repositories to evade detection. The worm’s evolution from post-install to preinstall execution hooks and the inclusion of destructive 'Dead Man’s Switch' payloads highlight its increasing sophistication and destructive potential, exacerbated by the public release of its source code which has spawned numerous clones.

Both Miasma and Shai-Hulud campaigns exploit compromised developer environments and CI/CD pipelines to earn legitimate provenance signatures, effectively bypassing traditional supply chain trust mechanisms and enabling the widespread distribution of malicious packages with millions of weekly downloads. Their multi-stage architectures incorporate self-propagation, credential harvesting, and encrypted payloads that defeat hash-based detection, while targeting AI coding assistants and IDEs to trigger payload execution seamlessly within developer workflows. These attacks reveal critical gaps in current security models, as provenance attestations confirm build origin but not intent, emphasizing the urgent need for enhanced behavioral monitoring and stricter pipeline controls to detect and mitigate malicious activity in AI-driven development ecosystems.

The keyv npm supply chain compromise further illustrates the operational complexity of multi-stage malware campaigns, where attackers inject obfuscated preinstall hooks that load larger second-stage payloads, granting attacker-controlled code execution with developer or CI runner privileges. Affecting multiple related packages maintained by jaredwray, some malicious releases remained tagged as latest during active incidents, complicating remediation efforts. The absence of clean successor versions necessitates immediate host isolation, persistence hunting, and credential rotation, highlighting the persistent operational challenges these multi-stage malware worms pose within developer environments and the broader npm ecosystem.

Attribution of these sophisticated npm supply chain attacks increasingly points to North Korean state-sponsored groups such as Sapphire Sleet (UNC1069), MIDNIGHT NEPTUNE, and UNC6780, whose campaigns span multiple packages including axios, debug, and chalk. Amazon Threat Intelligence and Google analysts have linked these actors through shared tradecraft, command-and-control infrastructure, and persistent social engineering tactics that compromise trusted maintainers, underscoring a geopolitical dimension to the threat landscape. Despite medium confidence in attribution and some delays in linking incidents, the consistent patterns reveal a financially motivated and highly persistent adversary exploiting open source ecosystems with billions of weekly downloads.

The broad impact on the open source ecosystem is profound, as compromising a single popular npm package like axios—with over 100 million weekly downloads and 175,000 dependent packages—can cascade malicious code downstream to thousands of projects and corporate scopes. This amplification effect erodes trust in the software supply chain, as attackers exploit maintainers’ credentials and legitimate publishing workflows to insert malware, exemplified by multi-stage campaigns such as the Shai-Hulud worm that earned authentic provenance signatures by hijacking CI/CD pipelines. The resulting erosion of confidence in provenance and signature mechanisms challenges the foundational assumptions of open source security.

Defending AI-driven development workflows and trusted software supply chains has become increasingly complex, as attackers chain together multiple vulnerabilities—ranging from social engineering and compromised vendor namespaces to abuse of GitHub Actions triggers and misconfigured CI/CD pipelines—to bypass traditional security measures. The rise of generative AI further complicates defense by enabling attackers to craft convincing malicious code, documentation, and maintainers, while also facilitating 'slopsquatting' attacks that exploit AI coding assistants’ package suggestions. This evolving threat landscape demands a holistic security approach that prioritizes breaking critical links in the attack chain rather than relying on isolated controls.

In response, platforms like GitHub and npm have implemented significant security enhancements focused on protecting high-impact maintainer accounts, restricting untrusted code execution in CI/CD workflows, and enforcing stricter governance over development and deployment processes. Measures such as placing sensitive npm accounts into read-only mode after critical changes, enabling trusted publishing without long-lived credentials, restricting cache modifications, and introducing enterprise-level workflow policies aim to reduce attack surfaces and credential exfiltration risks. These improvements, developed in close collaboration with security researchers and the developer community, are critical but must continually evolve to keep pace with the sophisticated, multi-stage, and AI-augmented nature of modern supply chain attacks.