Topic
The npm ecosystem is the primary package registry and tooling for JavaScript and Node.js, covering publishing, authentication tokens, and OIDC flows.
Worms spreading through npm in May and June 2026 committed a SessionStart hook to .claude/settings.json that runs a script when Claude Code opens the repo. Removing the package leaves that file in place, a dev.to write-up says.
Reality
Bloom Security found more than 1,500 npm packages, with over 10 million downloads, vulnerable to a publishing attack that needs no stolen credentials. Bloom also put AI-agent installs at about 70 packages a month on a typical endpoint, but its demonstration used only repositories its researchers controlled.
Reality
Tensorlake's npm SDK 0.5.144 runs a credential-stealing worm from a preinstall hook at install time, Socket reported. According to Socket's analysis, any secret reachable from a workstation or build runner that installed the release may be exposed.
Perspective Coverage
4 publishersReality
CVE-2026-6951 reopens remote code execution in simple-git, a library downloaded 8.7 million times a week, by respelling the blocked -c flag as --config. The 2022 patch never checked the long form, so the same attack works wherever untrusted input reaches a git call.
Reality
TanStack's postmortem says 84 malicious versions went out across 42 packages on 2026-05-11 with no npm token stolen, because a release job restored a cache that an untrusted pull_request_target build had written.
Reality
GitGuardian says the ChainDrop worm reached 444 npm packages by planting a SessionStart hook in Claude Code and a folderOpen task in VS Code, and the publishing credential it steals is used to republish inside the same session.
Reality
Akamai says the May 11-12 wave poisoned a CI cache and minted publish credentials from inside a trusted build, so the attestation it produced was honest. Any gate that only checks for provenance would have passed it.
Reality