A major supply chain attack hit npm after attackers used the compromised legitimate account “atool” to publish 637 infected versions across 323 packages in just 27 minutes. Those packages account for roughly 16 million weekly downloads, putting a large slice of the JavaScript ecosystem at risk.
npm told developers to rotate secrets and switch publishing method
npm issued an urgent alert telling developers to replace all existing secret keys at once and move to the more secure Trusted Publishing method. The goal is immediate containment: secure compromised projects quickly and remove malicious code from affected release paths.
Security researchers were not satisfied with that response. MetaMask security researcher Taylor Monahan said the delayed reaction pointed to a deeper infrastructure crisis. Moshe Siman Tov Bustan also argued that restricting access may slow the release of new malware packages, but it does not address the technical depth of the breach or stop the wider spread on its own.
“Mini Shai-Hulud” hides inside AI assistants and IDE settings
The malware highlighted in the incident, “Mini Shai-Hulud,” stands out because it adapts to normal developer workflows. After landing on a machine, it does more than collect data. It hides inside AI assistant configurations and IDE tool settings, which means the malware can be triggered again whenever those tools are launched. That is the critical detail.
The report says even after infected files are removed or a system is cleaned, reopening an AI assistant can start a new infection cycle. Stolen data includes AWS cloud credentials and crypto wallet private keys. The exfiltration is carried out in encrypted form through GitHub’s official API, making the traffic resemble ordinary code uploads from legitimate developers.
Revoking keys does not clean already infected machines
Researchers warned that revoking access keys may block fresh malicious releases, but it does not protect developers whose IDE environments have already been compromised by “Mini Shai-Hulud.” Once the spyware is embedded locally, it can continue stealing sensitive information quietly even if npm cuts off the publisher account from its side.
The incident has renewed focus on the fragility of dependency-driven software ecosystems. npm serves as a central repository for open-source packages used across JavaScript projects, and supply chain attacks exploit that trust by compromising third-party code or services. In this case, experts are pushing for stronger access models and a more complete investigation rather than relying on access restrictions alone.