Self‑propagating Worm Infects Hundreds of npm Packages, Threatening Billions of Downloads

Worm’s Mechanics Unveiled

A worm‑like attack has spread through the npm registry, compromising 444 packages from more than a dozen publishers. The malicious code now sits behind over two billion monthly downloads, putting countless JavaScript projects at risk. The infection was first traced to a hijacked GitHub account belonging to Jared Wray, the maintainer of the popular Keyv library.

Security researchers say the worm exploits the post‑install script feature that runs automatically when a package is installed. By injecting malicious commands into this script, the worm can download additional payloads and replicate itself across dependent packages. The initial breach occurred when the attacker gained access to Wray’s account, allowing them to publish a tainted version of Keyv. Subsequent victims were unaware that the compromised package was a dependency of their own projects, enabling rapid, silent propagation throughout the npm ecosystem.

The malicious code adds a tiny script to the package’s „install” hook. When a developer runs npm install, the script contacts a remote server, fetches additional malicious modules, and then modifies the newly installed package to include the same hook. This creates a self‑replicating loop that spreads without any user interaction beyond a standard installation. Researchers observed that the worm targets packages with high download counts, maximizing its reach. Because npm does not currently verify the integrity of post‑install scripts, the worm can slip past most automated checks. The attack’s speed is amplified by the interconnected nature of JavaScript dependencies, where a single compromised library can affect thousands of downstream projects.

Could This Worm Affect Your Projects?

If your codebase relies on any of the infected packages, you may already be running the worm on your machines. The infection is silent; it does not alter application functionality, making detection difficult. Developers are urged to audit their package‑lock.json files and check for unexpected post‑install scripts. Updating to the latest, clean versions of affected libraries can remove the threat, but the broader issue highlights the need for stricter supply‑chain security measures. npm has begun flagging suspicious packages, yet the sheer volume of modules means many vulnerable projects remain exposed.

The worm’s spread underscores a growing risk in open‑source supply chains. While npm works to improve vetting processes, the incident serves as a warning that even widely trusted libraries can become attack vectors. Ongoing monitoring, rapid patching, and a shift toward reproducible builds are likely to become standard practice as the community seeks to prevent similar outbreaks.

Frequently Asked Questions

How can I tell if my project is infected? Check your package‑lock.json or yarn.lock files for unexpected postinstall entries. Running a fresh install in a clean environment and monitoring outbound network traffic can also reveal hidden activity.

What steps should I take to clean an infected package? Remove the compromised dependency, reinstall a verified clean version, and run a full dependency audit. Consider using tools that lock down script execution during installation.

Will npm prevent similar attacks in the future? npm has announced plans to add stricter validation for lifecycle scripts and to improve automated scanning. However, the open nature of the registry means community vigilance will remain essential.