New supply chain attack hits npm registry, compromising 40+ packages

Researchers at Socket uncovered a new supply chain attack targeting the npm registry that impacted over 40 packages belonging to multiple maintainers. The attack began with a malicious update to @ctrl/tinycolor, a package with 2.2M weekly downloads on npm, and was linked to a broader campaign still under investigation. The rogue code tampered with package.json, injected a local script, and republished altered tarballs, trojanising downstream projects.

The malicious bundle.js downloads the legitimate TruffleHog scanner, profiles the host, and then scans files and repos for tokens and cloud credentials, reuses credentials, drops a GitHub Actions workflow using any available PAT, and exfiltrates findings (base64) to a hardcoded webhook.

The script also probes cloud metadata endpoints to harvest short‑lived credentials from build agents and plants a GitHub Actions workflow in repositories to enable future exfiltration during CI runs, a persistence mechanism that Socket notes can endure beyond the initial host. According to Socket’s report, indicators of compromise were published and developers are urged to uninstall or pin safe versions, audit developer and CI/CD environments, rotate npm tokens and exposed secrets, and monitor npm activity.