endorlabs.comarticleHow to Defend Against NPM Software Supply Chain Attacks | Blog | Endor Labs
Endor Labs blog post analyzing the wave of npm supply chain compromises (eslint-prettier, Nx, chalk, and the self-propagating "Shai-Hulud" worm that hit @ctrl/tinycolor via stolen maintainer credentials), citing the Zimmerman et al. study on npm's dense transitive-dependency trust model. It provides a checklist for security teams: enforcing lockfiles and npm ci in CI, defaulting to --ignore-scripts to block malicious lifecycle hooks, running SCA/malware scanning, and delaying adoption of new package versions (60-day cooldown per CIS benchmark, PNPM minimum-release-age feature).
TL;DR Practical checklist for defending against npm supply chain attacks (lockfile enforcement, ignore-scripts, SCA malware scanning, cooldown periods) framed around the Shai-Hulud worm and other recent npm compromises.
Organisations named here
- CIS Supply Chain Security Benchmark
- M Zimmerman et al. npm ecosystem study
- Shai-Hulud
Technologies named here
- npm ecosystem
- npm ci
- package-lock.json
- @ctrl/tinycolor
- pnpm-lock.yaml
- Express.js
- --ignore-scripts flag
- Spring
- pnpm
- Dependabot
- npm install --before flag
- Yarn npmMinimalAgeGate setting
- npm min-release-age setting
- OIDC Trusted Publishing
- Software composition analysis / malware scanning
- Reachability analysis/call graph analysis
- Endor Labs
- npm
Techniques named here
- Malicious lifecycle scripts
- Automated self-propagation via compromised credentials
- Malicious version publishing via long-lived tokens
Threat actors named here
- Shai-Hulud
- eslint-prettier compromise
- nx compromise
- chalk compromise
Related in Supply Chain
