NPM’s Shai-Hulud Defenses Vulnerable to Bypass via Git Dependencies

The vulnerabilities affecting NPM’s defenses, collectively termed PackageGate, were identified by Koi Security researchers. These weaknesses allow threat actors to bypass security measures through Git dependencies, impacting various JavaScript package managers, including pnpm, vlt, and Bun. The initial Shai-Hulud supply-chain attack occurred in mid-September 2025, compromising 187 packages, with a subsequent wave affecting 500 packages and exposing 400,000 developer secrets.

Despite the identification of these vulnerabilities, NPM has not taken action, stating that the behavior of their system ‘works as expected.’ This lack of response contrasts with the prompt actions taken by other package managers like Bun, which patched the flaws in version 1.3.5, and vlt, which addressed the issues shortly after being informed.

Researchers warned that the vulnerabilities could lead to severe consequences, including full code execution even when the ‘—ignore-scripts’ flag is set to true. They highlighted that proof-of-concept code has been published that exploits these weaknesses to create a reverse shell.

Implications for Users and Organizations

The ongoing vulnerabilities in NPM’s defenses underscore significant risks for developers and organizations relying on JavaScript packages. Users should be aware that malicious actors can leverage these weaknesses to execute harmful scripts, potentially compromising sensitive data.

Organizations should implement security measures recommended by GitHub, such as disabling lifecycle scripts during installation and enabling lockfile integrity and dependency pinning. These steps can help mitigate the risks associated with supply-chain attacks.

As the security of the npm ecosystem is a collective effort, developers are encouraged to adopt trusted publishing practices and utilize granular access tokens with enforced two-factor authentication. This can strengthen the overall security posture of their projects.