--- title: Four More Supply Chain Attacks Hit npm and PyPI | daily.dev description: Between early June and July 14, 2026, four distinct supply chain attacks targeted npm and PyPI ecosystems. The Shai-Hulud/Miasma worm spread to PyPI via a... canonical: https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Four More Supply Chain Attacks Hit npm and PyPI | daily.dev og:description: Between early June and July 14, 2026, four distinct supply chain attacks targeted npm and PyPI ecosystems. The Shai-Hulud/Miasma worm spread to PyPI via a... og:url: https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp og:image: https://api.daily.dev/og/posts/G68bUQQBP.png og:image:alt: Four More Supply Chain Attacks Hit npm and PyPI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Four More Supply Chain Attacks Hit npm and PyPI **[GitGuardian](https://daily.dev/sources/gitguardian)** · 7 min read · 7 upvotes · 0 comments ## Summary Between early June and July 14, 2026, four distinct supply chain attacks targeted npm and PyPI ecosystems. The Shai-Hulud/Miasma worm spread to PyPI via a Python startup file (.pth) mechanism, infecting over 100 packages total. Fake payment SDK packages (typosquatting PaySafe, Skrill, Neteller) harvested CI secrets like AWS keys and GitHub tokens. A stolen npm publishing token poisoned Jscrambler and its plugins with an IronWorm variant that targeted AI coding assistant credentials. Finally, a GitHub Actions 'pwn request' attack hijacked AsyncAPI's CI pipeline, backdooring packages with 2.25M+ weekly downloads — and the malicious releases carried valid Sigstore/SLSA provenance because the attacker controlled the CI identity. All four attacks shared one goal: stealing credentials from developer environments and build pipelines. npm v12 disabled install scripts by default, but attackers quickly pivoted to import-time execution, bypassing that protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did disabling npm install scripts by default in npm v12 not stop the jscrambler and AsyncAPI supply chain attacks? npm v12 disabled install scripts by default on July 8, closing what GitHub called the ecosystem's largest code-execution surface, but the jscrambler and AsyncAPI malicious packages executed their payloads on import or require() rather than during installation, completely bypassing that protection. Later jscrambler versions dropped the install hook specifically so npm install --ignore-scripts offered no defense. _Teams hardening CI pipelines against supply chain attacks can track defenses like this alongside real-world bypasses on daily.dev._ ### What made the AsyncAPI npm package backdoor via GitHub Actions hard to detect even though the packages had valid Sigstore and SLSA provenance? An attacker exploited a pull_request_target GitHub Actions workflow vulnerability, a known 'pwn request' pattern, to steal the highly privileged asyncapi-bot personal access token, then pushed malicious commits that the repository's own legitimate release workflow signed and published through npm's OIDC trusted publisher integration. Because the CI identity itself was compromised, the build system produced authentic Sigstore and SLSA attestations for backdoored code, proving where the package came from but nothing about whether the source was safe. _Developers evaluating provenance and SLSA guarantees can follow incidents like this that expose their limits on daily.dev._ ### What credentials did the compromised jscrambler npm packages target beyond typical cloud API keys? Beyond standard cloud credentials, the payload hunted for cryptocurrency wallets and, notably, the credential stores of AI coding assistants including Claude Desktop, Cursor, and Windsurf. JFrog identified the implant as an evolved variant of the Rust-based IronWorm infostealer, rebuilt to run on macOS and Windows and to automate its own propagation across npm packages. _Anyone securing AI coding assistant credentials alongside cloud secrets can track emerging threats like this on daily.dev._ ## Similar posts on daily.dev - [NPM Ecosystem Suffers Two AI-Enabled Credential Stealing Supply Chain Attacks](https://daily.dev/posts/npm-ecosystem-suffers-two-ai-enabled-credential-stealing-supply-chain-attacks-zb0mfsrht) · InfoQ · 0 upvotes · 0 comments - [No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours](https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr) · GitGuardian · 0 upvotes · 0 comments - [New npm supply-chain attack self-spreads to steal auth tokens](https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4) · BleepingComputer · 122 upvotes · 17 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Four More Supply Chain Attacks Hit npm and PyPI","url":"https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp"},"datePublished":"2026-07-22T14:04:59.462Z","dateModified":"2026-09-13T19:16:39.947Z","description":"Between early June and July 14, 2026, four distinct supply chain attacks targeted npm and PyPI ecosystems. The Shai-Hulud/Miasma worm spread to PyPI via a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d16ce7093d2ff8651043bd90879968ba?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d16ce7093d2ff8651043bd90879968ba?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitGuardian","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitGuardian","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/406f3b707b1741f7b988cf561463a54d","url":"https://daily.dev/sources/gitguardian"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,malware,github-actions,npm","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitGuardian","item":"https://daily.dev/sources/gitguardian"},{"@type":"ListItem","position":3,"name":"Four More Supply Chain Attacks Hit npm and PyPI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp#faq","mainEntity":[{"@type":"Question","name":"Why did disabling npm install scripts by default in npm v12 not stop the jscrambler and AsyncAPI supply chain attacks?","acceptedAnswer":{"@type":"Answer","text":"npm v12 disabled install scripts by default on July 8, closing what GitHub called the ecosystem's largest code-execution surface, but the jscrambler and AsyncAPI malicious packages executed their payloads on import or require() rather than during installation, completely bypassing that protection. Later jscrambler versions dropped the install hook specifically so npm install --ignore-scripts offered no defense. Teams hardening CI pipelines against supply chain attacks can track defenses like this alongside real-world bypasses on daily.dev."}},{"@type":"Question","name":"What made the AsyncAPI npm package backdoor via GitHub Actions hard to detect even though the packages had valid Sigstore and SLSA provenance?","acceptedAnswer":{"@type":"Answer","text":"An attacker exploited a pull_request_target GitHub Actions workflow vulnerability, a known 'pwn request' pattern, to steal the highly privileged asyncapi-bot personal access token, then pushed malicious commits that the repository's own legitimate release workflow signed and published through npm's OIDC trusted publisher integration. Because the CI identity itself was compromised, the build system produced authentic Sigstore and SLSA attestations for backdoored code, proving where the package came from but nothing about whether the source was safe. Developers evaluating provenance and SLSA guarantees can follow incidents like this that expose their limits on daily.dev."}},{"@type":"Question","name":"What credentials did the compromised jscrambler npm packages target beyond typical cloud API keys?","acceptedAnswer":{"@type":"Answer","text":"Beyond standard cloud credentials, the payload hunted for cryptocurrency wallets and, notably, the credential stores of AI coding assistants including Claude Desktop, Cursor, and Windsurf. JFrog identified the implant as an evolved variant of the Rust-based IronWorm infostealer, rebuilt to run on macOS and Windows and to automate its own propagation across npm packages. Anyone securing AI coding assistant credentials alongside cloud secrets can track emerging threats like this on daily.dev."}}]} ```