[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiHIjVVz6Ya8LlNoTrDNu01_qeLERoNdIMoRBz48auM8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"4f27f00b-a036-4a00-970b-7e645c05e347","npm-supply-chain-attack-compromises-open-source-maintainer-accounts-via-stolen-tokens","7e6ca802-2573-491b-a051-cfddbc35dcf2","npm Supply Chain Attack Compromises Open Source Maintainer Accounts via Stolen Tokens","Attackers compromised maintainer accounts for the widely-used 'keyv' and 'cacheable' npm packages by stealing authentication tokens, then pushed malicious code to downstream users. This is a classic supply chain attack: rather than targeting end users directly, adversaries exploit the trust placed in open source maintainers to distribute malware at scale. The incident underscores that open source maintainers — often volunteers with limited resources — are high-value targets whose credentials and tokens can propagate malware to thousands of dependent projects. Without robust token management, multi-factor authentication, and proactive dependency scanning, organizations consuming open source packages remain silently exposed.","**Immediate actions:**\n- Audit and rotate all npm publish tokens, especially for maintainers of widely-used packages.\n- Enable two-factor authentication (2FA) on all package registry accounts (npm, PyPI, etc.).\n- Run an immediate dependency scan to detect any recently published malicious versions of compromised packages.\n\n**Long-term improvements:**\n- Adopt a software composition analysis (SCA) tool to continuously monitor open source dependencies for malicious or unexpected changes.\n- Implement package pinning or lockfile integrity checks (e.g., `package-lock.json` verification) in your CI\u002FCD pipeline.\n- Establish an internal vetting process for dependency upgrades, requiring review before merging automated dependency update PRs.\n\n**Detection measures:**\n- Subscribe to security advisories from registries (npm Security Advisories, GitHub Dependabot) to receive real-time alerts on compromised packages.\n- Monitor build pipeline logs for unexpected network calls or anomalous behavior during package installation.\n- Use allowlist-based controls on outbound network access from CI\u002FCD build environments to limit malware exfiltration opportunities.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-218 SSDF: PO.5.2 (Secure Software Development Framework)","NIST CSF: ID.SC-4 (Supply Chain Risk Management)","SLSA Framework: Supply chain Levels for Software Artifacts","OpenSSF Scorecard: Token permissions and dependency pinning checks","NIST AC-2: Account Management (credential and token lifecycle)","NIST IA-5: Authenticator Management (MFA enforcement)",{},"published","2026-08-08T00:20:19.898706+00:00","2026-08-08T00:20:19.605+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fsocket.dev\u002Fblog\u002Ffree-business-plan-upgrades-for-open-source?utm_medium=feed","free-business-plan-upgrades-for-open-source-maintainers-553e64","Free Business Plan Upgrades for Open Source Maintainers",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[50,53,57],{"slug":33,"name":51,"problem":52},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":58,"name":59,"problem":60},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]