Supply Chain Attack: 14 Malicious npm Packages Downloaded 2.3 Million Times
Security researchers discovered 14 malicious npm packages that had been quietly injecting credential-stealing code into Node.js applications for over 6 months. The packages mimicked popular libraries with typosquatting names.
What Happened
Socket Security researchers discovered 14 malicious npm packages that had been published to the npm registry and downloaded approximately 2.3 million times over a period of six months. The packages used typosquatting — naming themselves with slight variations of popular, legitimate packages — to trick developers into installing them. For example, a package named "lodahs" instead of "lodash" or "expres" instead of "express". Once installed, the packages injected credential-stealing code that ran silently in the background, collecting environment variables, API keys, database credentials, and other sensitive information and sending it to attacker-controlled servers.
What Data Was Stolen
The malicious packages were designed to steal environment variables, which in Node.js applications often contain database connection strings, API keys, cloud provider credentials, and other sensitive configuration data. The packages also attempted to steal SSH keys and other credential files from the developer's home directory. In production environments, this could mean that attackers now have access to database credentials, cloud infrastructure credentials, and API keys for third-party services. Organizations that ran affected packages in production should assume that all environment variables and credentials on those systems are compromised.
Immediate Actions for Development Teams
First, check your package.json and package-lock.json files against the list of 14 malicious packages published by Socket Security (available at socket.dev/blog). If any of the malicious packages are present, remove them immediately and rotate all credentials that may have been exposed. Run npm audit on all of your projects to identify known vulnerabilities in your dependencies. Implement a software composition analysis (SCA) tool such as Snyk, Socket, or GitHub's Dependabot to automatically scan for malicious and vulnerable packages in your CI/CD pipeline. Consider implementing a policy requiring security review before adding new npm packages to your projects.
- Audit your package.json files for the 14 malicious packages listed in the Socket Security advisory
- Run a dependency security scan using npm audit or a dedicated SCA tool
- Implement a software composition analysis (SCA) tool in your CI/CD pipeline
- Review your npm package installation policies — consider requiring package review before installation
- Rotate any credentials that may have been exposed on systems running affected packages
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.