The worm in the package manager
Sep 17th, 2025 by Jesper Kråkhede
This month a self replicating worm spread through the npm ecosystem, the package registry used by most JavaScript developers. It stole credentials from developers´ machines, including tokens for npm and GitHub and keys for cloud services. Then it used the stolen npm tokens to publish infected versions of other packages owned by the same developers. Hundreds of packages were affected within days.
It is automation used for attack, in its purest form. No human had to choose the next victim. The worm did it.
What can development organisations do? Treat developer machines as high value assets. They hold the keys to your code, your pipelines and your cloud. Protect them like admin workstations, with EDR, strong authentication and as few stored secrets as possible.
Use short lived credentials. Tokens for package registries, source control and cloud should expire quickly and be scoped to what they need. Trusted publishing, where the pipeline publishes packages without long lived tokens, removes a whole class of problems.
Control what you install. Pin versions, use a lockfile, review new dependencies and consider a delay before adopting brand new package versions. Scan dependencies in the pipeline.
And make your pipeline the only way to production, so a stolen developer token can´t push straight to customers.
Code is a supply chain. Every package you install is someone else´s code running with your privileges.