Run `npm install` and any package in the tree can execute a postinstall hook during installation, before your application code runs [7]. Python has the same position available through a `.pth` file in `site-packages`, which the interpreter executes at startup, ahead of the first import [8]. The install line therefore grants execution inside a process that already inherits its environment, including `AWS_SECRET_ACCESS_KEY` and `GITHUB_TOKEN` [5], and nothing in the default flow reads the code first [6].
Resolution is the configurable half. npm and PyPI prefer the public version when its number is higher than the one in the internal private registry, so publishing `[email protected]` reaches any pipeline that depends on that name and has no registry lock [4].
The rate matters more than the totals. About 119,000 downloads across roughly 40 minutes is near 2,975 a minute [2], and an archive covering 434,000 pipeline runs works out to about 3.6 runs' worth of credentials per download [3]: one install line landing in a job that reruns, each run handing over a fresh set.
Two payload shapes are in play, the interception proxy that makes the real call and exfiltrates alongside it, and the facade that fabricates a response and never contacts the API at all [17]. The Paysafe packages skipped machines with fewer than two CPU cores or with VM-indicative usernames [15], which is a package fingerprinting the runner more carefully than the runner fingerprints the package. Obfuscation rotated per file, so no two of the 17 shared a hash [14].
Now transfer. Sonatype's Q1 2025 count was 17,954 malicious packages, 56% of them classified as data exfiltration [1], which is roughly 10,054 exfiltration packages in a single quarter [1], and the writeup puts Q2 volume growth at 188% year over year [3]. Those are counts of what was published, not of what your resolver will fetch. For that population to reach a given build, the resolver has to be allowed to reach it: floating version ranges, public-over-private precedence left at the default, lifecycle hooks enabled. A build that installs pinned hashes from an internal mirror with hooks disabled is still exposed to the maintainer-account compromise path, which is how the LiteLLM release shipped [9], but not to the confusion path.
One caution on the source. It reports counts, execution primitives and detection times, and credits Sonatype, Socket.dev, JFrog and THN, but it measures no control's effectiveness, and it dates the LiteLLM and Paysafe cases to 2026 while opening with 2025 telemetry. On what it does establish, the only gates sitting ahead of execution are which registry answers the resolve and what the environment holds when the hook fires.
