Back to feed
Dev.to
Dev.to
7/6/2026
npm Supply Chain Attacks 2025-2026: Account Compromise, Dependency Confusion, and the Phantom Gyp Technique

npm Supply Chain Attacks 2025-2026: Account Compromise, Dependency Confusion, and the Phantom Gyp Technique

Original: Every Time You Run npm install, You Are Trusting Hundreds of Strangers

Short summary

The npm ecosystem experienced multiple coordinated supply chain attacks in 2025-2026, exploiting account compromise, dependency confusion, and typosquatting to distribute malware across packages downloaded billions of times weekly. Attackers evolved techniques to bypass developer protections, including the Phantom Gyp method that triggers automatic C/C++ compilation without lifecycle scripts. The structural vulnerability lies in npm's automatic execution of scripts from transitive dependencies with full user permissions.

  • •Real incidents: Axios (174K downstream packages), Shai-Hulud worm (796 packages), Miasma attack (57 packages in 2 hours) with self-propagating infection via stolen credentials
  • •New technique: Phantom Gyp — 157-byte binding.gyp files trigger node-gyp compilation without lifecycle scripts, defeating --ignore-scripts protection
  • •Structural risk: 79 average transitive dependencies per project execute scripts with full user permissions, accessing AWS credentials, SSH keys, GitHub tokens, and CI/CD secrets

Generated with AI, which can make mistakes.

#research-breakthrough#industry-adoption#open-source
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

How a preinstall hook silently ran malware on npm install
Dev.to
Malicious 'jscrambler' NPM Package Versions Deploy Cross-Platform Infostealer in Sophisticated Supply Chain Attack
Dev.to
One npm Account Publishes 964 Million Downloads Per Week. None Have Provenance.
Dev.to
The original title is "A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack"
Dev.to