The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)

Executive Summary

The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape.

Since that watershed moment, Unit 42 has tracked an aggressive acceleration in the frequency and technical depth of supply chain compromises. Attacks have evolved from a series of isolated typosquatting incidents into systematic campaigns by various threat actors to weaponize the trust that powers modern software development.

April 2026 Campaigns

We have seen two campaigns in April: the first started April 22, 2026 and included the string Shai-Hulud: The Third Coming. The second started April 29, 2026 and is known as Mini Shai-Hulud.

May 2026 Campaigns

In May 2026, the Mini Shai-Hulud campaign continued with two new waves attributed to TeamPCP. These campaigns introduced two unique elements. One campaign used a credential-free initial access technique. The other campaign generated the highest single-hour package count of any Shai-Hulud worm to date. Copycat activity has made future attribution to TeamPCP more difficult.

June 2026 Campaign

A new supply chain attack on June 1, 2026 compromised at least 32 packages published under the @redhat-cloud-services npm namespace. The attacker bypassed code review entirely, pushing a payload named Miasma.

July 2026 Campaign

Attackers compromised the release pipelines of four core AsyncAPI GitHub repositories on July 14, 2026. In a campaign calling itself miasma-train-p1, they published five trojanized packages to npm:

• @asyncapi/generator@3.3.1
• @asyncapi/specs@6.11.2
• @asyncapi/specs@6.11.2-alpha.1
• @asyncapi/generator-helpers@1.1.1
• @asyncapi/generator-components@0.7.1

The payload appears to be a descendant of the Miasma remote access Trojan (RAT).

The New Baseline for npm Threats

The Shai-Hulud incident proved that the npm registry could be used as a force multiplier for malware distribution. In the months following, we have observed three core shifts in adversary TTPs:

• Wormable propagation: Malicious payloads now prioritize the theft of npm tokens and GitHub Personal Access Tokens (PATs) to automatically infect and republish legitimate packages, as seen in the March 2026 Axios compromise.
• Infrastructure-level persistence: Attackers are no longer just stealing data; they are embedding themselves into continuous integration/continuous delivery (CI/CD) pipelines to attain long-term, undetectable access to enterprise environments.
• Multi-stage payloads: Following the September 2025 template, current attacks often deploy dormant “sleeper” dependencies that only activate under specific environmental conditions to evade automated scanners.

npm Attacks Seen As a Whole

npm compromises have common themes. In the post-Shai-Hulud era, we believe it is helpful to consider the attack surface as a whole.

This article will combine:

1. Details of major incidents: Real-time analysis of significant package compromises (e.g., Shai-Hulud 2.0, Axios, Chalk/Debug)
2. Cross-campaign correlation: Identifying common infrastructure or code snippets that link disparate attacks to the same threat actors
3. Remediation playbooks: Actionable guidance for rotating credentials and purging malicious dependencies from local and cloud-based caches

Shai-Hulud: A New Wave

A malicious npm package published as @bitwarden/cli version 2026.4.0 was identified as part of a broader supply-chain campaign attributed to TeamPCP. The package impersonates the legitimate Bitwarden command-line interface (CLI) password manager. Upon installation, it executes a multi-stage payload that steals credentials from cloud providers, CI/CD systems and developer workstations. It then self-propagates by backdooring every npm package the victim can publish. It has been noted that inside public GitHub repositories that were published contained the string “Shai-Hulud: The Third Coming.”

Attackers deployed the same payload across multiple Checkmarx distribution channels, indicating a coordinated campaign to weaponize compromised developer tooling credentials to maximize the area of impact:

• Docker Hub images
• GitHub Actions
• VS Code extensions

Palo Alto Networks customers are better protected from the threats described in this article through the following products and services:

• Advanced WildFire
• Advanced URL Filtering and Advanced DNS Security
• Cortex Cloud

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

July 2026 - Miasma Expansion or Potential Copycat?

On July 14, 2026, attackers compromised the release pipelines of four core AsyncAPI GitHub repositories, publishing five trojanized packages to npm:

• @asyncapi/generator@3.3.1
• @asyncapi/specs@6.11.2
• @asyncapi/specs@6.11.2-alpha.1
• @asyncapi/generator-helpers@1.1.1
• @asyncapi/generator-components@0.7.1

The campaign calls itself miasma-train-p1, and the payload appears to be a descendant of the same Miasma RAT deployed in the June 2026 Red Hat supply chain operation. However, the initial access was different this time. Rather than a compromised employee account compromising the GitHub repository, the attackers exploited a process gap in the CI/CD pipeline itself.

The AsyncAPI repositories maintained strict branch protections and peer-review mandates on their primary main branches. However, pre-production release branches, specifically next and schema, were left unprotected. The threat actors pushed malicious commits directly to these shadow release branches that bypassed all human review (e.g., Commit 3eab3ec9304aa26081358330491d3cfeb55cc245 by attacker GitHub ID 148100). This commit triggered automated GitHub Actions build and release workflows.

The injected code ran inside the Continuous Integration (CI) runner itself, harvesting NPM_TOKEN and GITHUB_TOKEN environment secrets, then used the stolen npm token to programmatically publish backdoored package versions to the trusted @asyncapi scope on the public registry.

In contrast to the previous Miasma payload, this version’s architecture has changed. When a developer runs npm install on a compromised package, a backdoored source file executes, such as index.js, validator.js or utils.js.

To evade static code-integrity audits, the file exports a legitimate-looking schemas object with version-keyed JSON references. However, upon import, its main() function triggers a detached child process running an obfuscator.io-obfuscated script. That script determines the operating system via process.platform and creates a platform-specific persistence directory disguised as a legitimate NodeJS data folder:

• %LOCALAPPDATA%\NodeJS on Windows
• ~/Library/Application Support/NodeJS on macOS
• ~/.local/share/NodeJS on Linux
• ~/.config/node as a fallback

The payload then fetches the Stage-2 Miasma RAT from the InterPlanetary File System (IPFS) via a hard-coded content identifier (CID) Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf or QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9. It then writes the RAT as sync.js and spawns it with detached: true, stdio: 'ignore' and windowsHide: true.

The parent process calls child.unref() and exits cleanly, giving the perception that nothing is wrong. The RAT is now running headlessly in the background.

Once executing, the Miasma RAT writes an operational lockfile, ~/.config/.miasma/run/node.lock. It does so to prevent redundant instances and to establish persistence via a user-scoped systemd service (miasma-monitor.service on Linux and macOS, or a miasma-monitor Run key on Windows).

To bypass automated system audits, the RAT writes its host-tracking identity cache to paths that mimic legitimate OS application storage:

• ~/Library/Application Support/com.apple.spotlight/index-v2.cache on macOS (mimicking the Spotlight search index)
• ~/.cache/mesa_shader_cache/gl_cache.bin on Linux (mimicking the Mesa OpenGL shader cache)
• %HOME%\AppData\Roaming\Microsoft\CryptnetUrlCache\Content\msrt.dat on Windows (mimicking the Cryptnet certificate cache)

Credential theft targets are consistent with the June campaign:

• GitHub tokens
• npm tokens
• SSH keys
• Cloud provider credentials
• Kubernetes service-account tokens
• CI/CD secrets

Perhaps the most notable escalation is the command-and-control (C2) infrastructure. During the June Red Hat incident, the variant used a straightforward central C2 server. This campaign layers a decentralized fallback network on top of its primary C2 at 85.137.53[.]71. The RAT regularly polls hxxp://85.137.53[.]71:8080/api/v1/beacon for task commands. It also exfiltrates harvested credentials via HTTP POSTs to hxxp://85.137.53[.]71:8080/api/v1/file-result, forwarded to a dedicated upload listener on port 8081.

If the primary C2 IP address was blocked, the RAT accessed the public Ethereum RPC gateway at ethereum-rpc[.]publicnode[.]com to examine an on-chain smart contract (0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710), which functioned as a decentralized registry for the active C2 address. This contract was launched by the adversary wallet 0x92d4C5413e4F7B258a114964101F9e1C6d64C6Ba and included a backup contract located at 0x1969ab05d67b67fdcaa26240f738ccb077e1cd84.

If that was also blocked, the RAT established communication with public Nostr relays (wss://relay.damus[.]io and wss://relay.nostr[.]com/) as out-of-band backup channels. Finally, it implemented a BitTorrent DHT bootstrap routine (using router.bittorrent[.]com:6881 and dht.transmissionbt[.]com:6881) to join a peer-to-peer network and discover alternate controllers.

This was a highly redundant, resilient and evasive C2 architecture designed to survive standard domain and IP-level mitigation strategies. Blocking any single layer does not kill the implant.

On July 14, 2026, Unit 42 researchers analyzed a compromised macOS developer machine on which the developer opened a project workspace in GitHub Copilot. When the copilot parsed the workspace and triggered automated dependency loading, it imported the trojanized @asyncapi/specs@6.11.2 package. This silently launched the Stage-1 loader, which fetched Miasma sync.js from IPFS and spawned it under Homebrew Node.js v22, initiating active beaconing to 85.137.53[.]71:8080.

The developer did not run npm install manually. The tooling did it for them.

The campaign also features self-attributed configurations that suggest this is merely the first wave of a broader, phased rollout. The worm's self-propagation capability is limited to four hops via a hard-coded generation cap (maxGen = 4). Additionally, its rollout approach leverages a default canary deployment strategy (batch.defaultStrategy = CANARY), which initially infects 5% of potential targets before scaling up in waves of 100.

This is not runaway malware. It is rate-limited by design to manage exposure and avoid triggering widespread detection during the initial spread.

Attribution remains the same open question as with the June 2026 campaign. The Miasma campaign shares infrastructure hosting patterns with TeamPCP, including the same Dutch autonomous system (AS43641/VSYS-AMS) used in prior operations against AntV, TanStack and Red Hat. With the addition of this miasma-train-p1 campaign identifier it can be tied directly to the lineage that includes Mini Shai-Hulud and the June Red Hat compromise.

It is difficult to determine whether TeamPCP threat actors are directly behind this campaign. The Mini Shai-Hulud source code has been public since May 12 and nothing in this operation requires insider access to TeamPCP tooling.

June 2026 - Mini Shai-Hulud Spreads the Blight

On June 1, 2026, a new supply chain attack compromised at least 32 packages published under the @redhat-cloud-services npm namespace, with the malicious versions cumulatively averaging approximately 80,000 weekly downloads. The root cause was a compromised Red Hat employee GitHub account, used to push malicious orphan commits to multiple RedHatInsights repositories, bypassing code review entirely.

The attacker triggered GitHub Actions workflows to request OpenID Connect (OIDC) tokens, publishing Trojanized packages with valid SLSA provenance. The certificate was accurate, the packages really were built by that pipeline. It just also happened to have malware injected into it at the time.

The payload is called Miasma. It is named after the description that the malware stamps on attacker-created GitHub repositories, "Miasma: The Spreading Blight." The threat is derived from the Mini Shai-Hulud malware open-sourced by TeamPCP on May 12, with substantially identical tradecraft.

The analyzed sample replaced a normal approximately 200 KB index.js with a 4.29 MB obfuscated payload. This is a 25x size increase that is itself a reliable detection signal.

Stolen credentials include:

• GitHub tokens, npm tokens and SSH keys
• AWS, GCP and Azure credentials and cloud identities
• Kubernetes service-account tokens and HashiCorp Vault secrets
• CI/CD secrets from GitHub Actions, CircleCI and related platforms

Attribution remains uncertain. The TTPs are consistent with TeamPCP, but the public release of the Mini Shai-Hulud source code means any competent actor can replicate the same attack. What is certain is the trend, which is that one compromised account and one CI pipeline delivered 32 trojanized packages automatically to every developer who ran npm install. Then the registry does the rest.

May 2026 - Mini Shai-Hulud Continues

Two further waves in May 2026 continued the Mini Shai-Hulud campaign:

• The first introduced a fundamentally new initial-access technique that requires no stolen credential and produced the first malicious npm packages with valid supply chain levels for software artifacts (SLSA) provenance
• The second demonstrated the largest single-hour package count of any Shai-Hulud wave

Both are attributed to TeamPCP, though the public release of the worm's source code on May 12 has already spawned separate copycat activity, complicating future attribution.

May 11, 2026: Mini Shai-Hulud Strikes Again

On May 11, TeamPCP launched a coordinated supply chain attack across the npm and PyPI ecosystems. The initial vector was TanStack's GitHub Actions CI pipeline. Within six minutes, 84 malicious package artifacts were published across 42 @tanstack/* packages.

The worm's self-propagation mechanism then expanded rapidly. By end of day, we had documented 373 malicious versions across 169 npm packages plus compromised PyPI packages.

The affected scope went well beyond TanStack. The worm's self-propagation spread the compromise to packages across multiple industries and ecosystems:

• Enterprise infrastructure: @opensearch-project/opensearch (the official OpenSearch JavaScript client; versions 3.5.3–3.8.0) and 57 @uipath/* enterprise automation packages
• AI tooling: @mistralai/mistralai and its Azure/GCP variants, which is the official Mistral AI TypeScript client
• Specialized ecosystems: 19 @squawk/* aviation data packages, intercom-client@7.0.4 (customer messaging) and dozens of others across @tallyui, @draftlab, @beproduct, @mesadev and several unscoped packages

@tanstack/react-router alone receives over 12.7 million weekly downloads. We estimate 520 million cumulative downloads were in the affected window. Palo Alto Networks provides XDR and XQL queries to detect this activity.

A New Initial Access: No Stolen Credential Required

Every prior Shai-Hulud wave began with a stolen or phished credential. The TanStack attack needed neither. Instead, three GitHub Actions weaknesses were chained, none of which was sufficient alone.

Step 1: Pwn Request

On May 10, the attacker created a fork of TanStack/router under the account zblgg/configuration, deliberately named to avoid appearing in fork-list searches. A malicious commit was authored under the spoofed identity claude <claude@users.noreply.github.com>, impersonating the Anthropic Claude GitHub App, and prefixed [skip ci] to suppress automated CI on push.

A pull request (PR #7378) against TanStack/router#main then triggered bundle-size.yml — a workflow that used the pull_request_target trigger and checked out the fork's merge ref. This gave the fork's code execution in the base repository's runner context, with full access to its cache scope.

The threat actors used Bun, which is a lightweight JavaScript runtime and package manager alternative to Node.js and npm as shown in Figure 1. The attack used Bun to execute the malicious payload tanstack_runner.js. This in turn attempted to enumerate the system for sensitive credentials, including invoking the GitHub CLI to capture the GitHub authentication token (gh auth token).