npm ecosystem supply chain attacks exploit TypeScript maintainer workflows

The findings revealed that supply chain attacks ranked as the main concern, followed closely by dependency vulnerabilities and malicious code injection, which are ranked second and third, respectively. When attackers breached multiple npm packages—some with billions of downloads—they didn't just exploit individual weaknesses. They exposed systemic issues in how the ecosystem operates.

Attackers compromised the popular Nx monorepo build system by publishing malicious npm packages via a GitHub Actions exploit, injecting credential-harvesting malware that stole SSH keys, .env** ** files, wallets, and API tokens. This attack affected over 2,000 repositories.

The npm ecosystem saw a chain of incidents (s1ngularity, debug/chalk, Shai‑Hulud) that exposed systemic weaknesses in maintainer auth and CI workflows. Security responses now emphasize granular tokens, publish-time 2FA, and stricter release policies.