Loading today’s stories
Build1 distinct publisher3 min readPublished
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
"Earlier in the install process" is the phrase in that account doing the most work, and it is the one you cannot act on. The New Stack says the November variant moved its execution earlier to render developer triggers irrelevant [3]. It does not name the hook. If the new entry point is still a lifecycle script, installing with scripts disabled covers it. If it is not, that control covers the September payload and not the thing that replaced it. One sentence of a writeup does not settle which, and the difference is the difference between a fix and a speed bump.
The propagation step needs one thing to work downstream: a version number that something will resolve. It bumps the version and republishes under the maintainer's own name [7], so a consumer whose manifest carries a range picks up the poisoned build on its next resolve, while a consumer installing from a recorded exact version does not until someone re-resolves [1]. A lockfile inspects nothing. It declines to select a version that was not recorded when it was written, and that is the whole of its contribution here.
The same account describes the limit case. On August 4, 2026, a variant called ChainDrop compromised more than 400 packages in under four hours by riding a legitimate, cryptographically signed release pipeline, so each poisoned version arrived with a valid SLSA provenance attestation [10]. That is better than 100 packages an hour [2]. Its command channel sat inside an Ethereum smart contract, which renders domain blocklists moot [11]. The attestation was accurate, and that is the problem: provenance answers who built the artifact, not what the artifact does.
Treat 500-plus and 796 as counts from someone else's dependency graph. They are not even the same unit, since September counted package versions altered and November counted packages backdoored [1][3], so dividing them gives 1.59 and means nothing as a growth rate [3]. For either figure to reach your pipeline, one of those names has to sit in your tree, directly or transitively, and your install has to re-resolve a range rather than read a pin.
Two smaller details are worth keeping. The payload downloaded Trufflehog, a legitimate open source secret scanner, to confirm that the credentials it harvested were live [5]; the worm ships with a validation step that some internal secret audits skip. Palo Alto Networks' Unit 42 is moderately confident that parts of the script were written by an LLM, going on comments and emoji embedded in the payload [8].
The generalization in that piece holds up: swap npm publish for terraform apply and the mechanics hardly change [14]. Install-time execution with the permissions of whatever ran the install is a property of registries, not of JavaScript [12]. The worm never has to persuade a reviewer, because it only ever needed one credential and an install script [13].
Ranked by verification strength, evidence, and original report placement.
Beginning September 15, 2025, npm packages started updating themselves with no maintainer running npm publish and no pull request merged; between September 14 and 18, more than 500 package versions were altered, each carrying a payload that published more versions of more packages on more machines without human involvement.
Two months later, on November 24, a larger variant called Shai-Hulud 2.0 backdoored 796 packages, moved its execution earlier in the install process to render developer triggers irrelevant, and deleted the user's home directory if it could not find credentials to steal or a way to spread.
The compromised package runs a postinstall script (a single file called bundle.js) that searches the infected machine for anything resembling credentials, including npm and GitHub personal access tokens, AWS or GCP secrets, and whatever it can extract from a cloud instance's metadata service.
The payload downloads Trufflehog, a legitimate open source secret-scanning tool, and uses it to confirm the validity of any credentials it finds.
On locating a GitHub token, the worm exfiltrates everything to a new public repository and makes any private repositories it can reach public, republished under the original name with a "-migration" suffix appended.
If it finds an npm token, the worm calls the registry's API to list every package the compromised developer maintains, downloads them, injects itself into the postinstall step, bumps the version number, and republishes them with no further input.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Reading OIDC tokens out of runner memory: ChainDrop and the poisoned build1 distinct publisher
build
Every one of thirteen named 2025-26 incidents ran on a credential that still worked1 distinct publisher
build
56 build-pipeline attacks, one vendor's alert queue, and the February jump nobody can attribute yet1 distinct publisher
build
Resend is selling to the agent and handing the humans free templates1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One narrator, no second count
Every date, package count and behavioural detail in this story reaches the reader through a single retelling in The New Stack. The mechanism is described with the specificity of someone who has actually read the malicious code, which is why it hangs together — but there is no incident report, no registry statement and no independent tally standing behind the 500, the 796 or the 400. The one external voice, Unit 42, is quoted secondhand and only on the narrow question of whether a model helped write the script.
Packages counted, victims not
Three incidents arrive with hard numbers attached to the attack itself — 500-plus versions, 796 packages, 400-plus in four hours — and that is real, dated propagation rather than a proof of concept. The victim side is blank: not one affected organisation, no estimate of how many machines ran the postinstall script, and nothing on how many teams have actually moved to recorded checksums since. Spread is documented; blast radius is asserted.
Sober mechanism, tidy remedy
The reporting on how the worm works is restrained and specific, and it deserves credit for keeping Unit 42's hedge intact instead of promoting it to a finding. The overstatement sits at the two ends. The escalation arc invites you to read 500 then 796 as a curve, when the two figures count different things and cannot be divided into a growth rate. And The New Stack closes on pinning as 'the fix' immediately after describing an attack that came through a signed pipeline — a pin narrows which build you fetch, it does not decide whether the install should run code, nor does it survive the next re-resolve.
Trade voice with a prescription
Nobody with skin in the registries speaks here. What we have instead is a developer publication that walks from alarm to a specific tooling discipline — Terraform lock files, checksums since 0.14, commit SHAs for module sources — which is exactly the shape of writing that platform and tooling vendors like to see published. The only quoted researcher works for a commercial security vendor whose business includes naming and characterising threats, and its language-model judgement is the most quotable and least verifiable line in the whole account. None of that makes the analysis wrong; it does mean the incentive to dramatise and the incentive to prescribe both point the same way, and no counterparty is present to push back.
Detailed but unchecked
We can describe this story confidently and vouch for it only weakly. The internal mechanics are coherent enough that the propagation loop and the pin-versus-range consequence follow logically, and those parts we would stand behind. The chronology and every count depend on one publisher, one of the four variants is dated only to a season, and no registry-side or victim-side account exists in our coverage to test any of it against.