Engineering
Long-form analyses of the supply-chain attacks that keep us up at night, the defenses that stopped working, and the ones that still do.
-
TanStack and the provenance gap
On May 11, 2026, malicious npm artifacts were signed by TanStack's legitimate OIDC pipeline. Sigstore verified them. Provenance-only checks would have accepted them. Release-age cooldowns cover a different failure mode.
-
Bitwarden CLI was malicious on npm for 93 minutes
Between 5:57 and 7:30 PM ET on April 22, 2026, the npm tarball for @bitwarden/[email protected] was a credential harvester. Bitwarden contained it inside two hours. Any fresh install during that window should be treated as exposed.
-
pgserve: the npm worm that jumped to PyPI
On April 21, 2026, a self-propagating worm landed on npm as pgserve and then pushed malicious packages to PyPI. One install in one ecosystem became publish access in another.
-
The Asurion impersonation campaign: eight days, four fake packages, and a Slack webhook
Between April 1 and April 8, 2026, a campaign pushed four npm packages impersonating Asurion and its subsidiaries. The packages later turned into credential harvesters. The patient part is the lesson.
-
Three hours on npm: how the Axios compromise played out
On March 31, 2026, [email protected] shipped with a cross-platform RAT injected through a hijacked maintainer account. The malicious version was live for roughly three hours before npm pulled it. axios is in around 100 million installs per week. Three hours was enough.
-
Shai-Hulud 2.0: the worm came back, faster, and it has Zapier
Three months after the original Shai-Hulud npm worm, a new wave hit in November 2025. It runs earlier in the install lifecycle, harvests more credentials, and produced over 25,000 malicious GitHub repositories. Zapier, PostHog, and Postman were among the named victims.
-
Shai-Hulud: the npm worm that copies itself into your other packages
On September 15, 2025, a self-replicating worm appeared on npm. It stole credentials, used them to publish more malicious packages, and named its exfiltration repos after the sandworms from Dune.