NPM Worm Compromises Hundreds of Popular npm Packages

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages
• Blog Title: NPM Worm Compromises Hundreds of Popular npm Packages
• Suggested Section: Pentesting CI/CD → Github Security → Abusing Github Actions → GH Actions - npm Supply Chain Abuse

🎯 Content Summary

Incident, scope, and severity

Datadog reported on August 4, 2026, and updated the article on August 5, 2026, that a threat actor compromised hundreds of npm packages, including packages with more than 150 million weekly downloads. The attacker injected a self-propagating backdoor similar to the Shai-Hulud npm worm. The first identified malicious change was commit 174f6a5 in the...

🔧 Technical Details

npm lifecycle-script supply-chain backdoor: An attacker can publish or modify a package so its manifest adds or replaces a lifecycle command such as preinstall: node setup.mjs. Package managers that execute dependency lifecycle scripts run the loader during installation, before the application imports the package, providing code execution under the installing user's, CI runner's, or build environment's privileges.

Cross-platform runtime staging: A small loader can test for an installed bun with bun --version, accept any successfully exiting executable, or download a platform-specific Bun archive for Linux glibc or musl, macOS, or Windows. Weak controls such as following redirects, omitting response-size limits, failing to restrict redirect origins, not verifying the archive cryptographically, and using a temporary directory can make the staging process difficult to trust. Running the second stage under Bu...

🤖 Agent Actions

Updated:

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md

Added concise technical coverage of:

• Bun runtime staging and lifecycle execution.
• Runner memory and workflow-assisted secret extraction.
• npm token worm propagation requirements.
• VS Code and Claude developer-hook propagation.
• Blockchain dead-drop C2, encrypted exfiltration, and unsigned response execution.
• Public GitHub repository exfiltration/token relay.
• Incident reconstruction and behavioral hunting signals.
• Datadog research as numbered reference [18].

Validation passed: git diff --check, citation/reference integrity, balanced code fences, and correct footer. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages

Content Categories: Based on the analysis, this content was categorized under "Pentesting CI/CD → Github Security → Abusing Github Actions → GH Actions - npm Supply Chain Abuse".

Repository Maintenance:

• MD Files Formatting: 814 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0