npm supply chain attacks in 2026: what startup teams should change

An npm supply chain attack has hit trusted packages almost every month since March 2026. It started with axios in March, then came the Mini Shai-Hulud worm waves from late April. Red Hat, Jscrambler and AsyncAPI packages followed from late May to July. A wave hit more than 400 packages in August, and new compromises appeared as recently as October 8. Several releases carried valid provenance, and several ran on import, so blocking install scripts is no longer enough. npm and GitHub changed their defaults in response. Here is what happened and what we would change in a startup's setup this month.

What changed

The attacks, in order:

• axios, March 31: in the axios npm compromise, versions 1.14.1 and 0.30.4 were published from a compromised maintainer account and pulled in a malicious dependency, plain-crypto-js 4.2.1. Google Threat Intelligence Group attributes it to UNC1069, a North Korea-nexus actor.
• Mini Shai-Hulud, from April 29: the SAP-ecosystem packages mbt and several @cap-js packages shipped a preinstall hook that stole npm tokens and used them to republish other packages. It also committed .vscode/tasks.json and .claude/settings.json files so it ran again when someone opened the repo.
• TanStack, May 11: 84 malicious versions across 42 @tanstack/* packages went out in about six minutes, through the project's own trusted-publisher setup in GitHub Actions. It is CVE-2026-45321, rated critical, and CISA added it to its Known Exploited Vulnerabilities catalogue on May 27.
• @antv and related packages, May 19: a preinstall payload read secrets straight from GitHub Actions runner memory. Microsoft reports that GitHub removed 640 malicious packages and invalidated 61,274 write-capable npm tokens that bypassed two-factor authentication.
• Red Hat, May 29 to June 1: a GitHub account hijacked through a malicious VS Code extension pushed code that compromised 32 @redhat-cloud-services packages.
• Jscrambler, July 11: an attacker used an npm publishing credential to push malicious versions. From 8.18.0 the payload ran when the package was imported, not at install. Version 8.22 is safe.
• AsyncAPI, July 14: a pull_request_target workflow ran attacker code and exposed a bot token. The project's own release workflow then published five poisoned versions, all with valid provenance attestations. Microsoft notes that --ignore-scripts did not stop it.
• ChainDrop, August 4: a Mini Shai-Hulud variant spread to more than 400 packages, including keyv, flat-cache and cache-manager.
• October 5 and 8: @subql/common 5.8.3 and tensorlake 0.5.144 were compromised. The tensorlake malware watches its stolen GitHub token and runs an attacker handler if the token is revoked.

The platform response:

• December 9, 2025: npm revoked all classic tokens. npm login now issues two-hour session tokens.
• May 22, 2026: staged publishing became generally available, so a maintainer must approve a release before anyone can install it. New --allow-file, --allow-remote and --allow-directory flags arrived in npm 11.15.0.
• July 8, 2026: npm v12 became generally available. With npm v12, install scripts from dependencies, git dependencies and remote URL dependencies no longer run or resolve unless you allow them.
• July 14, 2026: Dependabot now waits three days before opening a version update. Security updates still open at once.
• July 28, 2026: npm scans new packages for malware at publish time, which usually adds about five minutes before a version is available.
• July 31, 2026: npm restricted granular tokens that bypass two-factor authentication. GitHub is targeting January 2027 to remove their direct publishing.

Who is affected

• Every team that runs npm install, pnpm install or yarn on laptops or in CI: web front ends, Node back ends, React Native apps and build tooling.
• Teams that publish their own packages or SDKs from GitHub Actions, especially with long-lived tokens or pull_request_target workflows.
• Developers whose machines hold cloud keys, GitHub tokens and SSH keys. The stealers targeted exactly those.
• Teams that use AI coding tools and editors that run project config on open. The April wave planted files for both.
• Anyone who installed an affected version during an exposure window, even through a transitive dependency.

What to do now

1. Check your exposure. Search every lockfile for the affected packages and versions listed in the advisories below. If one ran on a laptop or runner, treat that machine as compromised.
2. Isolate first, then rotate. Socket's tensorlake analysis says to isolate affected hosts and remove the malware's token monitor before revoking any tokens. Then rotate cloud, GitHub, npm and SSH credentials from a clean machine.
3. Commit lockfiles and install with npm ci (or the pnpm and yarn equivalents) so CI installs exactly what you reviewed.
4. Move to npm v12 defaults. Keep dependency scripts off and allow only the ones you trust with npm approve-scripts, then commit that allowlist.
5. Do not stop at blocking scripts. Jscrambler, AsyncAPI and @subql/common ran on import. Scanning, cooldowns and least-privilege CI still matter.
6. Add a cooldown. npm's min-release-age, pnpm's minimumReleaseAge and Dependabot's new default all delay brand-new versions. The bad axios versions were live for about three hours, and Socket flagged tensorlake 11 minutes after it was published, so even a short delay helps.
7. Take long-lived tokens out of CI. GitHub ranks it first among its recommendations. Publish with npm trusted publishing and staged publishing, and move off 2FA-bypass tokens before January 2027.
8. Harden GitHub Actions. Do not run untrusted pull request code with secrets, scope tokens to the job, use protected environments for releases, and pin third-party actions.
9. Treat provenance as a signal, not proof. TanStack and AsyncAPI shipped malware with valid attestations from their real pipelines.

Key dates

1. December 9, 2025npm classic tokens revoked.
2. March 31, 2026axios 1.14.1 and 0.30.4 compromised.
3. April 29, 2026first Mini Shai-Hulud wave.
4. May 11, 2026TanStack wave (CVE-2026-45321).
5. May 19, 2026@antv wave.
6. May 22, 2026staged publishing generally available.
7. June 1, 2026Red Hat disclosure.
8. July 8, 2026npm v12 generally available with install scripts off by default.
9. July 11 and 14, 2026Jscrambler and AsyncAPI compromises.
10. August 4, 2026ChainDrop wave across more than 400 packages.
11. October 8, 2026tensorlake 0.5.144 compromised.
12. January 2027target date for removing direct publishing from 2FA-bypass tokens.

How we help with npm supply chain attacks

Most of these fixes are configuration, not rewrites. Our code security audit checks your dependencies, lockfiles and exposure to the packages above. A DevOps consultant can move your CI and publishing to short-lived credentials, npm v12 defaults and hardened GitHub Actions, planned around your release schedule. If a bad version already ran in your pipeline, start with software project rescue. npm token and install-time dates also sit in our software end-of-life tracker for startup stacks.