Introducing NPM Package Search: Find Where Any Package Was Introduced Across Your GitHub Organizations

StepSecurity has announced NPM Package Search, a new capability that lets you trace any npm package to its origin across your GitHub organisations, including every repository, pull request and contributor. The article notes that in September 2025 the Shai-Hulud Worm compromised over 500 npm packages, stealing cloud credentials and tokens to propagate further.

It also highlights the September 2025 Singularity compromise tied to the Nx build system, where a malicious version of the @nx/singularity package exfiltrated tokens and credentials. In July 2025, the eslint-config-prettier attack infected a package with over 30 million weekly downloads, delivering Scavenger malware via modified install scripts.

The piece emphasises that NPM Package Search can show the full history of how each dependency entered and evolved within an organisation, including which developer added it and when. It underlines that this tool supports incident response, dependency auditing and blast radius assessment by providing PR-level visibility across your codebase.