What is npm?

A novel npm supply-chain attack pattern uses npm purely as file storage and Unpkg as a CDN to serve malicious Cloudflare-verification pages from legitimate domains, bypassing developer-install-based detection entirely.

“Unlike traditional npm supply chain attacks, the packages don't infect developers who install them. Instead, attackers use npm as storage and services such as unpackage to render the malicious pages from legitimate domains, potentially helping them evade security controls.”

npm is mandating interactive 2FA for all new publishes starting January 2027, a change that will eliminate npm worms but break significant ecosystem automation.

“In January 2027 going to require human you know interactive confirmation through 2FA before any new publishes can happen.”

Codex NPM installs grew roughly 10x from about 100,000 per day in January 2026 to over 1 million per day by May 2026, with recent spikes reaching 1.5 to 1.8 million per day.

“Simon again shared a chart of NPM installs of Codex, which means when Codex was installed directly through a terminal interface. He points out that they were at about 100,000 a day in January and are at over a million a day right now. In fact, in the last couple of days they've surged up to 1.5 and 1.8 million.”

Attackers time npm worm launches to coincide with RSA and Black Hat conferences, exploiting reduced defender attention during major security events.

“I noticed the attackers seem to pick RSA and black hat as the times they wanted to start these npm worms.”