Attackers weaponize npm provenance attestations to hide supply-chain worm

More than 400 npm packages fell victim to a coordinated supply-chain attack this week, with researchers uncovering a credential-harvesting worm deployed through stolen developer credentials. The incident underscores a worrying shift: adversaries are now targeting the very developers and publication workflows that the ecosystem relies upon to remain trustworthy.

How the worm propagated#

According to Microsoft Threat Intelligence, the compromised packages contained a variant of the Mini Shai-Hulud worm that moved laterally through developer environments after gaining initial access via stolen maintainer credentials. The malware scanned both developer machines and CI/CD systems for additional credentials, then weaponized any npm publishing tokens it discovered.

Each time the worm found a valid token, it performed the following steps:

• Downloaded the latest version of every package accessible to that account
• Injected malicious preinstall lifecycle hooks into the code
• Incremented the patch version number
• Published the infected packages

Because npm executes preinstall hooks automatically before installation completes, the malware launched on developer workstations and CI runners before any application tests or security scans could intervene.

Persistence and lateral movement#

In CI environments, the worm remained active throughout the job lifecycle, giving it access to workflow secrets, runner credentials, and publishing permissions. On developer machines, it established persistence by modifying startup files in Visual Studio Code and other tools, including .vscode/tasks.json and Claude configuration files.

Provenance attestations weaponized as cover#

The attack exposed a critical flaw in how the ecosystem trusts published code. Rather than relying on stolen long-lived credentials, malware executing inside a legitimate workflow could generate its own short-lived publishing token directly from the build environment. Remarkably, the resulting malicious packages carried valid provenance attestations, essentially using the integrity-verification mechanism as camouflage.

This disconnect reveals that provenance signing alone cannot guarantee the safety of a package—only that it came from an authorized source.