<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4" -->

---
title: New npm supply-chain attack self-spreads to steal auth...
description: A new self-propagating supply chain attack has been discovered in the npm ecosystem, targeting packages from Namastex Labs. The malware, found in 16...
canonical: https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: New npm supply-chain attack self-spreads to steal auth tokens | daily.dev
og:description: A new self-propagating supply chain attack has been discovered in the npm ecosystem, targeting packages from Namastex Labs. The malware, found in 16...
og:url: https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4
og:image: https://api.daily.dev/og/posts/p3MYKAWe4.png
og:image:alt: New npm supply-chain attack self-spreads to steal auth tokens
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# New npm supply-chain attack self-spreads to steal auth tokens

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 122 upvotes · 17 comments

## Summary

A new self-propagating supply chain attack has been discovered in the npm ecosystem, targeting packages from Namastex Labs. The malware, found in 16 compromised packages, steals developer credentials including npm publish tokens, API keys, SSH keys, cloud service credentials, CI/CD secrets, and cryptocurrency wallet data from browsers. Once it finds npm publish tokens on a compromised system, it injects itself into every package that token can publish and republishes them with an incremented version number, enabling recursive worm-like spread. It also targets PyPI if Python credentials are found, making it a multi-ecosystem threat. Developers using the listed package versions should remove them immediately, rotate all secrets, and audit CI/CD pipelines for indicators of compromise.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/>

## Community discussion

Top comments from developers on daily.dev.

**@crismihalache84** · 21 upvotes

> This is basically a worm for the package ecosystem—once it grabs a publish token, it turns every package into a new infection vector.
>
> The cross-ecosystem angle (npm + PyPI) makes it especially dangerous. If you’ve touched any affected packages, assume compromise: rotate everything and audit your pipelines immediately.

**@mr\_guy** · 14 upvotes

> Now running `install [package]` turns you into a probable victim

**@abhiroop43** · 5 upvotes

> First axios and now this. The JS/TS ecosystem just keeps getting hit.

**@bennamanemourad** · 3 upvotes

> Nice to see that

**@alance** · 2 upvotes

> So many reasons why I stay away from npm and nodejs.
>
> I still trying to understand why people still use dangerous tools. Why people don't change?

## Similar posts on daily.dev

- [Another npm supply chain worm hits dev environments](https://daily.dev/posts/another-npm-supply-chain-worm-hits-dev-environments-birdicj09) · The Register · 0 upvotes · 0 comments

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm)

[View this post on daily.dev](https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"New npm supply-chain attack self-spreads to steal auth tokens","url":"https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4"},"datePublished":"2026-04-22T13:01:01.456Z","dateModified":"2026-04-22T13:03:43.838Z","description":"A new self-propagating supply chain attack has been discovered in the npm ecosystem, targeting packages from Namastex Labs. The malware, found in 16...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff576e42c916d3b05d978602faf5b426?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff576e42c916d3b05d978602faf5b426?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":17,"discussionUrl":"https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":122},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":17}],"keywords":"cyber,nodejs,malware,npm","timeRequired":"PT3M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New npm supply-chain attack self-spreads to steal auth tokens"}]}
{"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4","comment":[{"@type":"Comment","text":"This is basically a worm for the package ecosystem—once it grabs a publish token, it turns every package into a new infection vector.\nThe cross-ecosystem angle (npm + PyPI) makes it especially dangerous. If you’ve touched any affected packages, assume compromise: rotate everything and audit your pipelines immediately.","datePublished":"2026-04-23T08:52:28.020Z","url":"https://daily.dev/posts/p3MYKAWe4#c-lzEOGk5L5","author":{"@type":"Person","name":"Cris Mihalache","url":"https://daily.dev/crismihalache84","image":"https://avatars.githubusercontent.com/u/272221164?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":21}},{"@type":"Comment","text":"Now running install [package] turns you into a probable victim","datePublished":"2026-04-23T12:18:42.272Z","url":"https://daily.dev/posts/p3MYKAWe4#c-D8Fvh7cSo","author":{"@type":"Person","name":"mr_guy","url":"https://daily.dev/mr_guy","image":"https://media.daily.dev/image/upload/s--kA2286Qs--/f_auto/v1717237879/avatars/avatar_Vmm9zE1OjqAn7kdD7jR0t"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":14}},{"@type":"Comment","text":"First axios and now this. The JS/TS ecosystem just keeps getting hit.","datePublished":"2026-04-26T05:02:39.464Z","url":"https://daily.dev/posts/p3MYKAWe4#c-MHGdcUrr5","author":{"@type":"Person","name":"Abhiroop Santra","url":"https://daily.dev/abhiroop43","image":"https://avatars.githubusercontent.com/u/5673129?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5}},{"@type":"Comment","text":"Nice to see that","datePublished":"2026-04-26T07:24:24.264Z","url":"https://daily.dev/posts/p3MYKAWe4#c-vprhCNkQq","author":{"@type":"Person","name":"Bennamane Mourad","url":"https://daily.dev/bennamanemourad","image":"https://avatars.githubusercontent.com/u/90926833?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"So many reasons why I stay away from npm and nodejs.\nI still trying to understand why people still use dangerous tools. Why people don’t change?","datePublished":"2026-04-26T11:13:06.686Z","url":"https://daily.dev/posts/p3MYKAWe4#c-7qsgWoe9E","author":{"@type":"Person","name":"Etienne Lessard","url":"https://daily.dev/alance","image":"https://lh3.googleusercontent.com/a/ACg8ocIbCx2XrWmzaJr_arihNf8aiW_heIwOxO6FBCHSnUeuX35n=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}}]}
```