npm Supply-Chain Attack Exposes Open-Source Dependencies: 2024 Incident Analysis
Executive Summary
In June 2024, a supply-chain attack struck the widely used npm ecosystem when a threat actor compromised developer Josh Junon's account via a phishing-enabled two-factor reset. The attacker injected malicious code into 18 high-download open-source JavaScript packages, including 'ansi-styles', 'chalk', and 'debug', targeting cryptocurrency transactions. Although the incident caused significant alarm due to the downloads’ reach (>2 billion/week), rapid detection by the open-source community and immediate takedown by npm limited the impact. The injected packages were removed within hours, and the attacker ultimately stole just over $1,000 in cryptocurrency.
This incident highlights the growing sophistication of supply-chain and social engineering attacks on open-source platforms. As attackers target developer credentials and critical project maintainers, organizations face renewed urgency to reassess their software supply chain controls and dependency management.
Why This Matters Now
Open-source supply-chain attacks are rising, leveraging social engineering and targeting trusted developer accounts to poison widely used dependencies. The npm incident underscores the urgent need for stronger authentication, vigilant incident response, and comprehensive monitoring of third-party software components, as similar threats continue to emerge across the industry.
Attack Path Analysis
The attacker initiated the campaign by social engineering an npm package maintainer and gaining access to their account. Leveraging this access, they escalated privileges to inject and publish malicious code into popular open-source packages. The attacker then relied on lateral movement as users and projects unknowingly pulled these poisoned packages into various environments. Upon execution, the malicious code communicated with external infrastructure to establish command and control channels. Through these channels, cryptocurrency-related data was exfiltrated to the attacker's wallet. Although the overall impact was minimized due to rapid detection and remediation, some limited cryptocurrency theft occurred.
Kill Chain Progression
Initial Compromise
Description
The attacker employed phishing (2FA reset social engineering) to compromise the npm maintainer's account credentials.
Related CVEs
CVE-2025-54313
CVSS 8.8Malicious code injection in eslint-config-prettier package allows remote code execution.
Affected Products:
eslint eslint-config-prettier – 8.10.1, 9.1.1, 10.1.6, 10.1.7
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Valid Accounts
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Compromise Account
Obfuscated Files or Information
Data Manipulation: Stored Data Manipulation
Data Obfuscation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for All System Components
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Cybersecurity Program
Control ID: 500.02
DORA – ICT risk management: identification and protection
Control ID: Article 9(2)
CISA ZTMM 2.0 – Enforce Multi-Factor Authentication
Control ID: Identity Pillar: MFA Enforcement
NIS2 Directive – Supply Chain Security
Control ID: Article 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply-chain attacks targeting npm packages directly threaten software development workflows, requiring enhanced egress security and anomaly detection for development infrastructure protection.
Financial Services
Cryptocurrency-focused malware in compromised packages poses direct financial theft risks, necessitating zero trust segmentation and threat detection capabilities for transaction security.
Information Technology/IT
Open-source dependency management vulnerabilities expose IT infrastructure to supply-chain compromises, demanding multicloud visibility and kubernetes security for containerized application environments.
Computer/Network Security
Security vendors relying on npm packages face reputational and operational risks, requiring inline IPS capabilities and secure hybrid connectivity for development-to-production pipelines.
Sources
- The npm incident frightened everyone, but ended up being nothing to fret abouthttps://cyberscoop.com/open-source-npm-package-attack/Verified
- CrowdStrike Falcon Prevents Supply Chain Attack Involving Compromised NPM Packageshttps://www.crowdstrike.com/en-us/blog/crowdstrike-falcon-prevents-npm-package-supply-chain-attacks/Verified
- Software packages with more than 2 billion weekly downloads hit in supply-chain attackhttps://arstechnica.com/security/2025/09/software-packages-with-more-than-2-billion-weekly-downloads-hit-in-supply-chain-attack/Verified
- Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attackhttps://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Deployment of Zero Trust Segmentation, strict egress security, threat detection, and workload isolation controls could have detected, contained, or blocked the attacker’s malicious updates and outbound data flows from compromised CI/CD or production workloads. Consistent identity segmentation and egress filtering are critical to reduce software supply-chain risk in cloud environments.
Control: Multicloud Visibility & Control
Mitigation: Prompt detection of anomalous access to privileged accounts.
Control: Zero Trust Segmentation
Mitigation: Restricts role privileges, impeding attacker lateral movement from a single account.
Control: Kubernetes Security (AKF)
Mitigation: Limits malicious pod or workload-to-workload spread in cloud-native and containerized environments.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks unauthorized outbound traffic from workloads to attacker infrastructure.
Control: Encrypted Traffic (HPE)
Mitigation: Secures data in transit to minimize risk of intercepted credentials and enables traffic inspection.
Rapid detection of anomalous activity reduced blast radius.
Impact at a Glance
Affected Business Functions
- Software Development
- Cryptocurrency Transactions
Estimated downtime: 1 days
Estimated loss: $1,000
Potential exposure of developer credentials and cryptocurrency transaction data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement workload-to-workload microsegmentation and identity-based Zero Trust policies to stop privilege abuse and lateral spread.
- • Enforce strict egress controls at cloud and container boundaries to block malicious outbound connections and data exfiltration.
- • Utilize centralized multicloud visibility and baselining to rapidly detect privilege anomalies and unauthorized code publishing.
- • Apply runtime and Kubernetes-native segmentation to limit toxic blast radius of compromised packages or containers.
- • Routinely monitor for threat and anomaly signals across the pipeline and leverage inline response to suspicious package activity.
