How npm packages steal our data - Supply Chain Attacks

In a software supply chain attack involving npm, malicious actors target the open-source dependencies that modern applications rely upon. Instead of directly breaking into a target's primary codebase, attackers infiltrate the ecosystem by publishing malicious packages using techniques like typo squatting (naming a fake library similarly to a popular one), account takeover (stealing a legitimate maintainer's npm credentials), or dependency confusion (tricking build systems into downloading malicious public packages over private ones).

Once a compromised package is fetched during npm install, the malicious payload automatically triggers through built-in npm lifecycle hooks such as preinstall or postinstall, executing arbitrary code before the application even runs. During this build phase, the script quietly performs environment reconnaissance to harvest sensitive data from developer workstations or CI/CD pipelines. This harvested data includes environment variables (process.env), cloud credentials (such as AWS keys), SSH keys, API tokens, database passwords, and npm authentication tokens.

Finally, the malware silently exfiltrates these stolen secrets to an attacker-controlled Command and Control (C2) server, a webhook endpoint, or via DNS tunneling queries.
To protect against these attacks, developers should enforce --ignore-scripts on untrusted installations, pin exact versions using package-lock.json, implement automated security tools (such as Snyk or Socket) in their pipelines, and restrict secrets in developer and build environments following the principle of least privilege.