--- title: The npm Threat Landscape: Attack Surface and Mitigations description: Unit 42 analyzes the post-Shai-Hulud npm threat landscape, detailing a sophisticated April 2026 supply chain attack attributed to TeamPCP. The campaign... canonical: https://daily.dev/posts/the-npm-threat-landscape-attack-surface-and-mitigations-fyqozxiba twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The npm Threat Landscape: Attack Surface and Mitigations | daily.dev og:description: Unit 42 analyzes the post-Shai-Hulud npm threat landscape, detailing a sophisticated April 2026 supply chain attack attributed to TeamPCP. The campaign... og:url: https://daily.dev/posts/the-npm-threat-landscape-attack-surface-and-mitigations-fyqozxiba og:image: https://api.daily.dev/og/posts/FYqOzXibA.png og:image:alt: The npm Threat Landscape: Attack Surface and Mitigations og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The npm Threat Landscape: Attack Surface and Mitigations **[Unit 42](https://daily.dev/sources/unit42)** · 16 min read · 0 upvotes · 0 comments ## Summary Unit 42 analyzes the post-Shai-Hulud npm threat landscape, detailing a sophisticated April 2026 supply chain attack attributed to TeamPCP. The campaign impersonated @bitwarden/cli to deploy a self-replicating worm that steals npm tokens, GitHub PATs, and cloud credentials (AWS, Azure, GCP), then backdoors every package the victim can publish. The malware uses multi-stage obfuscation, AES-256-GCM encrypted exfiltration, GitHub public repos as secondary exfiltration channels, GitHub Actions workflow injection, and a GitHub Search API dead drop for C2 resilience. The same payload simultaneously compromised Checkmarx Docker Hub images, GitHub Actions, and VS Code extensions. Mitigations include disabling lifecycle scripts, version pinning with npm ci, private registry proxying, egress filtering in CI/CD, provenance verification, and SBOM generation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/the-npm-threat-landscape-attack-surface-and-mitigations-fyqozxiba) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The npm Threat Landscape: Attack Surface and Mitigations","url":"https://daily.dev/posts/the-npm-threat-landscape-attack-surface-and-mitigations-fyqozxiba","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-npm-threat-landscape-attack-surface-and-mitigations-fyqozxiba"},"datePublished":"2026-04-24T21:53:00.312Z","dateModified":"2026-04-28T14:06:26.233Z","description":"Unit 42 analyzes the post-Shai-Hulud npm threat landscape, detailing a sophisticated April 2026 supply chain attack attributed to TeamPCP. The campaign...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a2210c8bb65ce5c30d66fd50fbb19b3a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a2210c8bb65ce5c30d66fd50fbb19b3a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-npm-threat-landscape-attack-surface-and-mitigations-fyqozxiba","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"The npm Threat Landscape: Attack Surface and Mitigations"}]} ```