Quick Summary
In December 2025, npm implemented a significant authentication overhaul to combat supply-chain attacks following the Sha1-Hulud incident. This included revoking classic tokens and introducing session-based tokens with mandatory multi-factor authentication (MFA) for publishing. Despite these improvements, npm projects remain vulnerable to malware attacks, highlighting ongoing risks for developers and users in the Node community.
The Securityish Brief
In December 2025, npm completed a major authentication overhaul in response to the Sha1-Hulud incident, which highlighted vulnerabilities in its supply chain security. The overhaul involved revoking all classic tokens, which were long-lived credentials that could be exploited by attackers to publish malicious packages. Instead, npm has transitioned to short-lived session tokens, typically valid for two hours, and encourages the use of OIDC Trusted Publishing for enhanced security.
Despite these changes, npm projects are still at risk of malware attacks. Notably, the original attack on tools like ChalkJS involved a successful MFA phishing attempt, where attackers tricked maintainers into sharing their login credentials and one-time passwords. This indicates that even with improved security measures, the potential for exploitation remains if users are not vigilant.
Another concern is that MFA on publish remains optional. Developers can still create 90-day tokens with MFA bypass enabled, which resembles the classic tokens that npm sought to eliminate. This allows unauthorized access to a maintainer’s console, enabling attackers to publish malicious packages.
Ongoing Risks and Recommendations
While npm’s efforts to improve security are commendable, the persistence of MFA phishing attempts and optional MFA for publishing means that supply-chain risks are still present. Developers must remain aware of these vulnerabilities and take proactive steps to secure their packages.
Future recommendations include promoting the widespread adoption of OIDC, enforcing MFA for local package uploads, and adding metadata to package releases to inform developers about security measures taken by maintainers. These steps could significantly reduce the risk of supply-chain attacks.
Chainguard offers a solution by building npm packages from verifiable upstream source code, which could mitigate the risk of malicious packages. Their approach has shown that 98.5% of compromised packages contained malware not present in the upstream source code, emphasizing the importance of building from source.
In summary, while npm has made strides in enhancing security, the combination of ongoing MFA phishing risks and the optional nature of MFA for publishing means that developers and organizations must remain vigilant and adopt best practices to protect against supply-chain attacks.
Key Takeaways
- Implement multi-factor authentication (MFA) for all npm accounts to enhance security against phishing attacks.
- Regularly review and update token management settings to ensure only short-lived tokens are used.
- Educate team members about the risks of MFA phishing and how to recognize suspicious communications.
- Consider using Chainguard Libraries to build npm packages from verifiable source code to reduce exposure to malicious packages.
- Advocate for mandatory MFA for package publishing within your organization to minimize risks.
Key Terms & Concepts
- OIDC: In this article, OIDC refers to OpenID Connect, a secure authentication protocol that enhances identity verification.
- MFA: In this article, MFA stands for multi-factor authentication, a security measure requiring multiple forms of verification before granting access.
- Supply-chain attack: In this article, a supply-chain attack is a type of cyber attack that targets vulnerabilities in third-party software or services to compromise systems.
- Chainguard: In this article, Chainguard refers to a company that provides security solutions for building software from verified source code.
Read the original article here: https://thehackernews.com/2026/02/npms-update-to-harden-their-supply.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
