Popular NPM Package ‘ctrl/tinycolor’ with 2M Weekly Downloads and 40+ Others Compromised in Supply Chain Attack

The popular NPM package ctrl/tinycolor, together with over 40 other JavaScript packages, was compromised in a self-propagating supply chain attack that has escalated threats in the ecosystem. The incident targets versions 4.1.1 and 4.1.2, which collectively receive over 2 million weekly downloads from developers worldwide, and a multi-stage infection chain automatically spreads to additional packages.

The attack was first discovered by security researcher @franky47 and reported through a GitHub alert, with analysis shared by Socket[.]dev, according to Socket[.]dev. The malicious campaign creates a GitHub Actions workflow to maintain persistence and harvests credentials such as NPM tokens, GitHub personal access tokens, and cloud keys, exfiltrating data to webhooks.

The compromised packages have been removed from the NPM registry, and a broad set of maintainers and libraries—including angulartics2 (v14.1.2) and various @ctrl namespace packages—were affected. Industry players like StepSecurity have highlighted protective measures such as monitoring for new dependencies and unauthorised publications to mitigate future spread.