The Shai‑Hulud campaigns exploited the fact that a single unnoticed version bump or lockfile modification could bring a malicious tarball into thousands of projects. Those controls must extend beyond npm itself to pnpm, Bun, and other modern package managers, so that your defaults are consistent across all tooling in the workspace. Incidents like eslint-scope showed that once an attacker obtains credentials, they can publish backdoored versions to millions of users. Your goal is to sandbox your development environment so npm malware doesn’t own your host. These create reviewable PRs with context (changelogs, CVEs) instead of silently changing your lockfile. Your goal is to upgrade with review and signals, not “everything to the latest”.
2FA is not required by default, but from December 2025, when you create a new package, 2FA will be enabled by default in the package settings. Container-based development are also gaining adoptions, especially with the Development Containers specification that is focused on enriching containers with development specific https://ativanx.com/2018/10/24/digital-money-transfer-service-azimo-expands-its-european-operations-with-new-amsterdam-office/ content and settings. The native modules may not provide the same level of functionality, but they should be considered whenever possible. However, this does not provide security guarantees in the presence of malicious code.
This guide shares some npm security best practices that we first published in 2019, and further strengthens and extends them to incorporate modern practices and lessons learned from the supply chain attacks we’ve witnessed in 2025. This list was originally based on the 10 npm security best practices from the Snyk blog. Many package managers provide audit functionality to scan your project’s dependencies for known security vulnerabilities, show a report and recommend the best way to fix them. The Aikido Safe Chain wraps around the npm cli, npx, yarn, pnpm, pnpx, bun, bunx, and pip to provide extra checks before installing new packages
SBOM Analysis
Use the helper script default.sh to setup these defaults across package managers automatically. Production builds use npm ci, not npm install, so the resolved dependency tree is exactly the one that was reviewed. For current vulnerable packages and CVE-specific guidance, see the npm security vulnerabilities reference. CI/CD pipelines and automated builds that run npm install without version pinning can pull malicious updates automatically. Finally, effective npm security is not just about https://dominicanrental.com/mozhno-li-razvernut-nejroset-na-svoem-servere.html installing dependencies. When publishing via trusted publishing, npm automatically generates provenance attestations that provide cryptographic proof of package authenticity.
- The supply chain audit walkthrough is where the workflow above gets tested against a real dependency tree.
- Container-based development are also gaining adoptions, especially with the Development Containers specification that is focused on enriching containers with development specific content and settings.
- However, this does not provide security guarantees in the presence of malicious code.
- The Lazarus Group published 800+ malicious packages on npm in 2025, with 97% targeting the JavaScript ecosystem (Sonatype, 2026).
- Your goal is to avoid installing a package until it passes basic security and sanity checks.
The npm ecosystem is the single largest repository of application libraries among all the other language ecosystems. Rushing to constantly upgrade dependencies to their latest releases is not necessarily a good practice if it is done without reviewing release notes, the code changes, and generally testing new upgrades in a comprehensive manner. The npm CLI builds on scripts that a package can declare, and allows packages to define scripts to run at specific entry points during the package’s installation in a project. Luckily, there is a way to tell both Yarn and npm to adhere to a specified set of dependencies and their versions by referencing them from the lockfile.
We have documented this pattern across multiple npm supply chain attacks at CyberDesserts in the last year, from individual maintainer compromises like axios to four generations of the self-replicating Shai-Hulud worm. That is the dependency tree, and it has been the implicit trust surface of software for fifteen years. According to Sonatype’s 2026 State of the Software Supply Chain report, 2025 saw 9.8 trillion downloads across Maven Central, PyPI, npm, and NuGet combined. Layering multiple tools provides the most comprehensive coverage. Check npm ls to see your full dependency tree including transitive dependencies. For deeper analysis, use Socket or Snyk for behavioural malware detection.
Cyprus Airways Data Breach: Hackers Claim Access to Real-Time Systems and Passenger Records
- Malicious packages in npm surged from 38 reports in 2018 to over 2,168 in 2024 (arXiv, 2025).
- We can set a delay to avoid installing newly published packages.
- Modern JavaScript provides many built-in capabilities that previously required external libraries.
- But they also have the disadvantages of being more complex to setup and maintain, and can be more expensive (cost of storage and bandwidth) to use.
- The npm ecosystem is the single largest repository of application libraries among all the other language ecosystems.
Blindly upgrading all dependencies to their latest versions can expose your application to security vulnerabilities, dependency confusion attacks, and malicious packages released from compromised accounts. Package managers like npm and yarn compensate for inconsistencies between package.json and lockfiles by installing different versions than those https://clomidxx.com/idc-shares-top-2019-predictions-for-cios-agility-connectivity-and-an-eye-on-results/ recorded in the lockfile. Direct dependencies listed in your root package.json are still permitted to use exotic sources. Attackers can update the lockfile to specify a new source location (in the resolved key) that they control, and set the SHA512 integrity value accordingly to avoid detection. Furthermore, JavaScript package managers allow users to install packages from unconventional sources, such as GitHub gists or directly from source code repositories. Both JavaScript package managers, Yarn and npm, were found to be susceptible to lockfile injection attacks.