AI
Why npm Was Built to Be Exploited
npm launched in 2011-2012, before security was a design concern. Its foundational philosophy, “no batteries included,” was built into Node from the start: the language was designed to pull in external packages for everything, from string padding to basic utilities. That design compounded into a structural problem. Pre-install and post-install scripts run arbitrary code before or after a package lands on disk. Brian Fox from Sonatype calls this “rce by design.” A malicious post-install script is the simplest possible remote code execution pipeline.
The Scale of npm’s Malware Problem
A Sonatype study found 98.5% of all malicious open source packages exist in npm. The “no batteries included” design explains the concentration. GitHub data shows the average JavaScript project carries 10 direct dependencies and 683 transitive dependencies. PHP sits at 9 direct and 70 indirect. If you added every other language’s transitive dependency count, JavaScript still wins. That attack surface compounds because npm doesn’t require 2FA on new accounts. McCarty timed himself: a Gmail, GitHub, and npm account took under 5 minutes to stand up.
Why Security Tools Cannot Detect Intentional Malware
Open source malware is source code, not binaries. Reverse engineering skills built on years of binary analysis don’t transfer. Payloads are highly iterative: one package McCarty tracked had 19 versions over 2 months, rotating C2 IP addresses and payload encoding three or four times. Sandboxes like Any.run and Joe’s can’t call Node to run JavaScript on their free tiers. Obfuscation is not proof of malice either. Developers obfuscate JavaScript to hide business logic. Detection engines that flag obfuscation as malicious produce false positives and miss intent entirely.
CI/CD Pipelines: The High-Value Target
CI/CD pipelines concentrate the two things attackers want most: source code and credentials. AWS access tokens and npm publish tokens both live there. Security tools almost never run inside those pipelines. GitHub’s free tier purges CI logs after 90 days, so a malicious event from day 91 leaves no trace. Developers also carry the most EDR exclusions of any role in the enterprise, alongside the executive suite. SCA tools catch known CVEs but were never designed to detect intentional backdoors. That combination makes developer environments the path of least resistance.
How Threat Actors Use npm
Lazarus Group has stolen over $2 billion in crypto in the last 18 months through npm-based campaigns. They flood npm and PyPI with dependency confusion and typosquatting packages, then reference those packages in LinkedIn and GitHub social engineering attacks. Their payloads now use conditional logic: check for Solana wallet files, then Tron tokens, escalating only when they find what they want. A second group McCarty tracks, the “len gang” (Indonesians posing as Vietnamese women), exfiltrates everything to Discord. Bug bounty researchers account for 40% of malicious packages McCarty reviews monthly.
Notable Quotes
In fact, neither is true. Paul “6mile” McCarty · ▶ 3:10
install scripts in npm he calls that rce Paul “6mile” McCarty · ▶ 5:01
That’s just not true. Paul “6mile” McCarty · ▶ 13:51
Key Takeaways
- A malicious package McCarty reported in December 2024 stayed in the npm registry until May 2025.
- 98.5% of malicious open source packages live in npm; JavaScript projects average 683 transitive dependencies.
- Nation-state actors (Lazarus Group) stole over $2 billion in crypto via npm campaigns in 18 months.
- Developers carry more EDR exclusions than any other role, making them the softest target in any org.
- Package firewalls from Sonatype or Safety intercept malicious packages before they land on disk.
About the Speaker(s)
Paul McCarty is Head of Research at Safety and a DevSecOps practitioner with 30 years of experience, having worked for NASA, Boeing, Blue Cross/Blue Shield, John Deere, the US military, and the Australian government. He founded UtahConnect, SecureStack in 2017, and SourceCodeRED in 2023. McCarty is a frequent contributor to the OpenSSF malicious packages repository and was its top contributor for six months. He is currently writing “Hacking NPM.”