Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs

The Acceleration: How Supply Chain Attacks Went Industrial Across npm, PyPI, VS Code, and AI Agent Tooling

Executive Summary

Supply chain attacks in 2026 do not look like growth. The Phoenix Security Malware Package Intelligence (MPI) corpus covers 59 supply chain attack campaigns from June 2024 through June 2026 and indexes 657 individual malicious package-versions as concrete, scanner-ready IOCs. When you plot that corpus month by month, the curve looks like ignition.

The full year 2025 produced 14 campaigns and 111 indexed packages. The first half of 2026 alone produced 37 campaigns and 497 indexed packages — 2.6 times the campaign count and 4.5 times the package volume of the entire preceding year. May 2026 was the single busiest month on record: 14 campaigns and 346 indexed packages in 31 days, more than the four months before it combined. That spike has a specific cause. One self-propagating worm event in May generated 226 of those 346 indexed packages, and the worm is still the defining technical innovation of this period: a mechanism that converts a single compromised maintainer token into hundreds of poisoned packages without human input between hops.

Phoenix Research – Campaign analysis

The external ecosystem data tells the same story from a wider angle. Phoenix Security tracked a 188 percent year-over-year jump in malicious open source packages in Q2 2025, followed by a 140 percent quarter-over-quarter increase in Q3 2025, with 454,600 new malicious packages across the year and a cumulative total that crossed 1.23 million. ReversingLabs found that npm malware more than doubled in 2025 and now represents nearly 90 percent of all open source malware the firm detects. Meanwhile, PyPI and NuGet malware declined 43 and 60 percent, respectively, after those registries shipped mandatory 2FA and trusted publishing — confirming that attackers do not grind through friction, they route around it.

Two new attack surfaces entered active production during this period. The VS Code Marketplace went from near-zero malicious activity to 7 documented campaigns in 18 months, with ReversingLabs recording detections that nearly quadrupled from 27 in 2024 to 105 in the first 10 months of 2025. AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, AI coding assistant SessionStart hooks — moved from theoretical concern to confirmed delivery mechanism across at least 14 of 59 tracked campaigns (note some of those data might be due to limited visibility pre-2025, nonetheless the acceleration is clear)

Across all 59 campaigns, CVE count: zero during active exploitation. Every single one.

TL;DR for Engineering Teams

Threat Overview

The Acceleration Curve

Year over year

2026 is barely half over and has already produced more than 2.6 times the campaign volume and 4.5 times the package volume of the entire preceding year. Projected linearly, 2026 is on track for approximately 74 campaigns and around 1,000 indexed packages — a roughly 5-fold year-on-year step after 2025 had already nearly doubled 2024.

Inside 2026 — the curve steepens month over month

May 2026 is the single busiest month on record across the entire two-year corpus. Fourteen distinct campaigns, 346 indexed packages, more than the prior four months of 2026 combined. The May spike is the signature of automation: Mini Shai-Hulud Wave 2 alone contributed 226 of those 346 indexed packages, against a reported real-world total of 170+ distinct packages. A single worm event now eclipses a quarter of manual campaigns in volume.

Ecosystem Breakdown

Where the malicious packages live

npm is the dominant target by a wide margin: nearly 4 in 5 indexed malicious packages, present in 63 percent of all campaigns. PyPI is the steady second front, appearing in 19 campaigns with lower individual IOC volume because Python attacks tend toward lower-volume, higher-precision payloads: RATs, banking trojans, crypto-stealers rather than mass typosquat sprays.

The PyPI and NuGet malware declines in external vendor data (down 43% and 60% per ReversingLabs) are the most important nuance in the entire dataset. They confirm that registry-level security controls work, and that attackers respond to friction by relocating rather than persisting. npm’s slower adoption of equivalent controls explains why it now absorbs the majority of displaced volume.

VS Code extensions: zero to seven campaigns in 18 months

The VS Code Marketplace barely registered as an attack surface before late 2024. It now spans seven distinct campaigns:

The developer editor has become an attack surface carrying full developer privileges, persistent across projects, and extending into every AI coding tool fork. ReversingLabs confirmed the detection rate nearly quadrupled: 27 malicious extensions detected in 2024, rising to 105 in the first 10 months of 2025. The GitHub breach via a poisoned extension is the operational proof point that this surface now reaches the highest-value targets in the software supply chain.

AI agent tooling and MCP: the newest frontier

The leading edge of the corpus targets the tooling that sits around the developer rather than a traditional package registry:

TrapDoor introduced the most novel technique in the full corpus: injecting hidden instructions into AI coding assistant configuration files using zero-width Unicode characters, so the developer’s own assistant becomes the exfiltration mechanism — running what appears to be a "security scan" that actually harvests secrets. The campaign opened pull requests to browser-use/browser-use, langchain-ai/langchain, and langflow-ai/langflow to distribute the poisoned configs. Miasma Wave 2 extended the technique, dropping backdoor configs into project directories for Claude Code, Cursor AI, and Google Gemini simultaneously. The Mini Shai-Hulud SAP CAP persistence mechanism is the clearest example of what makes this surface distinct from a package install: the hooks survive package uninstall entirely, re-running credential harvest on every subsequent session.

Quantified scan data: AI-agent skills carry a markedly higher risk rate than IDE extensions. A focused deep-scan run on 2026-05-24 across 3,267 skills produced findings that are the clearest internal signal of the AI-shift thesis:

AI-agent skills carry a risk rate 2.3 times higher than IDE extensions. The deep-scan risk breakdown for the 3,267-skill focused run:

More than 1 in 4 deep-scanned skills triggered a critical-risk finding. The most-triggered detection rules reveal a consistent pattern — shell command execution combined with network egress:

High-star, widely-trusted skills appear in the critical set — a setup-deploy skill in a 97,000-star repository triggered critical findings. Popularity provides no safety signal.

The attack model across all five campaigns in this cluster: the AI coding assistant loads a project-level skill or MCP server containing hidden instructions. The assistant executes those instructions as part of normal operation, exfiltrating secrets without the developer ever running a suspicious binary. The AI is not compromised — it is used as designed, against the developer. External validation confirms this is a recognised attack class: Snyk’s ToxicSkills research documents malicious AI-agent skills, and Datadog’s open dataset now formally tracks “AI Skills” and “IDE extensions” as first-class malware ecosystems alongside npm and PyPI.

Threat Actor Breakdown

Two distinct adversary archetypes define the period:

DPRK: human-in-the-loop, espionage and financial. The Contagious Interview playbook lures developers through fake job offers, then delivers OtterCookie and BeaverTail RATs through npm and PyPI packages. Lower package volume, higher targeting precision. Campaign 69 confirmed a first: DPRK supply chain activity expanding to Packagist/PHP, following the Laravel-Lang attack pattern. Credit OpenSourceMalware for first signal

TeamPCP plus Shai-Hulud lineage: machine-speed, self-propagating. These are worms. They steal a maintainer’s npm or GitHub token, republish trojanized versions, and use the stolen credentials to infect the next namespace automatically. This is what produces the May 2026 volume spike. The worm has been operational across at least six named waves, each introducing new delivery or evasion capability within 72 hours of the prior wave being detected and documented.

IronWorm (June 2026) is the engineering ceiling for this period. A move away from interpreted JavaScript postinstall scripts toward a compiled 976 KB Rust binary with a kernel-level eBPF rootkit, per-call-site string encryption, Tor C2, and OIDC-based self-propagation through 37 npm packages across 9 organizations. It signals that supply chain malware is professionalizing toward the capability level of nation-state implants. Credit Jfrog for the first signal.

Campaign Timeline: May–June 2026 (The Densest Six Weeks on Record)

Key Campaigns in Technical Detail

Shai-Hulud lineage: three waves, one propagation engine

The Shai-Hulud worm established the template for self-propagating npm supply chain compromise and every subsequent wave inherits from it.

Wave 1 (September 2025): Started with @ctrl/tinycolor at over 2 million weekly downloads.

ReversingLabs identified ngx-bootstrap@18.1.4 (approximately 300,000 weekly downloads) as the probable patient zero for the broader first wave, which compromised over 500 npm packages. The worm harvested npm tokens, GitHub tokens, and cookies, then automatically republished poisoned versions of every package a compromised maintainer could reach, capped at 100 packages per victim.

Node.js-based monolithic bundle.js payload via a postinstall lifecycle hook. The Qix compromise — which hit chalk@5.6.1 and debug@4.4.2 (combined approximately 2.6 billion weekly downloads) and the ansi cluster (ansi-styles, ansi-regex, strip-ansi, supports-color, wrap-ansi, color, color-convert, color-name) — occurred in this wave, representing the highest-reach single compromise event in the dataset.

Wave 2 (November 2025): Branded “Sha1-Hulud: The Second Coming.” Datadog tracked 1,092 unique backdoored package versions across at least 796 packages with a combined 130 million monthly downloads. Patient zero: @asyncapi/specs at 1.4 million weekly downloads, cascading through corporate namespaces including Zapier, Postman, PostHog, ENS Domains, Browserbase, and the AsyncAPI organization itself (36 distinct packages trojanized). The 2.0 wave switched from postinstall to preinstall and adopted the Bun runtime as a Node.js detection bypass.

Wiz tracked over 25,000 attacker-created exfiltration repositories across roughly 350 GitHub users at a peak rate of 1,000 new repositories every 30 minutes.

Mini Shai-Hulud (April–May 2026): Three distinct named sub-waves, all inheriting the worm branding and expanding the technical surface:

• SAP CAP wave (April 29): OIDC trusted-publishing entry point on a misconfigured release workflow. First confirmed introduction of Claude Code SessionStart hooks and VS Code tasks.json folderOpen triggers as persistence mechanisms. ~1,800 attacker-controlled credential-dump repositories created. C2: zero.masscan[.]cloud:443/v1/telemetry.
• atool/AntV wave (May 19): 323 packages across 27 minutes via two compromised npm accounts. Payload reads GitHub Actions Runner.Worker process memory to extract CI/CD secrets in plaintext, bypassing log masking. 2,500+ attacker repositories created.
• PyTorch Lightning PyPI bridge (April 30): First confirmed cross-ecosystem Shai-Hulud expansion into PyPI. lightning@2.6.2 and 2.6.3 (8.3M monthly downloads) compromised with a Python-to-JavaScript execution bridge — downloads Bun, executes router_runtime.js. Novel because it bypasses PyPI signature verification, which covers only Python code.

The worm’s design principle across all waves: each compromised maintainer’s token publishes poisoned versions of every other package that maintainer owns, creating a cascade from a single stolen credential.

TeamPCP (UNC6780): 19 campaigns, multi-ecosystem coordination

TeamPCP is the most active single actor in the corpus and the clearest example of supply chain compromise operating as a coordinated production pipeline across ecosystems simultaneously.

The five-day CI/CD siege in March 2026 (TEAMPCP_TRIVY_KICS_WAVE1) started from a single incompletely-rotated GitHub PAT from a prior breach and force-pushed 110+ version tags across Aqua Security’s trivy-action (75 of 76 version tags poisoned), setup-trivy, Checkmarx’s kics-github-action (35 tags), and ast-github-action — simultaneously poisoning two OpenVSX extensions, multiple container registries, and 66+ npm packages. The payload swept 50+ credential paths and exfiltrated via vendor-specific typosquat domains. CanisterWorm used an Internet Computer Protocol (ICP) blockchain canister as a C2 dead-drop — the first npm malware to do so — making conventional domain takedown impossible.

The Bitwarden CLI compromise (April 22, 2026) demonstrated the same pattern applied to a password manager: @bitwarden/cli@2026.4.0 poisoned for a 93-minute window via an injected GitHub Actions step in Bitwarden’s own CI pipeline. The payload (bw1.js) shares core infrastructure with the mcpAddon.js from the KICS wave. TeamPCP publicly claimed responsibility.

The MEGALODON_CI campaign on May 18 deployed 5,718 malicious GitHub Actions workflow commits across 5,561 repositories in six hours, using throwaway CI-bot accounts with forged identities and a September 2001 backdated timestamp. A dormant workflow_dispatch backdoor activates on any future pipeline run triggered via the GitHub API — creating a persistent sleeper army. CISA issued an advisory naming Megalodon alongside the Nx Console VS Code extension and Trivy.

The GitHub internal breach (May 20, 2026) is the campaign with the highest-value confirmed impact in the corpus: roughly 3,800 GitHub-internal repositories exfiltrated after a poisoned VS Code extension reached an employee endpoint, with StepSecurity confirming Sigstore attestation forgery used to make the extension appear legitimately signed. Persistence via .vscode/tasks.json folderOpen tasks and ~/.claude/settings.json SessionStart hooks — both survive extension removal.

TeamPCP’s defining operational characteristic is the TTP pivot speed. The group adopted the VS Code folderOpen auto-run primitive from Lazarus Group’s Contagious Interview campaign and integrated it into crimeware within approximately eight weeks of public documentation. The Miasma Wave 2 delivery pivot — from postinstall to binding.gyp shell expansion — occurred within 72 hours of the prior detection being publicized.

IronWorm: the capability ceiling

IronWorm represents a generational step in supply chain malware engineering. Distributed through 37 packages republished under the compromised asteroiddao npm account across 9 organizations, each package carries a 976 KB Rust ELF binary fired from a preinstall hook.

The binary uses a custom-modified UPX stub to defeat signature-based unpackers and encrypts every internal string with a unique per-call-site key. An embedded eBPF kernel-level rootkit hides the worm’s own processes, sockets, and anti-debugging tripwires. The implant sweeps 86 environment variables and over 20 credential file paths covering AWS, GCP, Azure, Vault, Kubernetes, npm, Docker, GitHub, and the full current generation of AI provider keys (Anthropic, OpenAI, Gemini, Cohere, Mistral, Groq, Perplexity, xAI). A dedicated Exodus desktop wallet hook weakens Electron sandboxing to capture the seed mnemonic at unlock. C2 runs over Tor. Propagation uses npm Trusted Publishing OIDC token exchange: on any CI runner with active federation, the worm exchanges the runner’s identity token for a short-lived, scoped publish token and republishes itself under every namespace the runner can reach — no stored npm token required.

The operator hardcoded their own BIP-39 recovery phrase in the wallet-stealer skip list, an operational security failure that reads as a rehearsal artifact rather than a finished operation.

TrapDoor: the AI-tool attack surface

TrapDoor is the first confirmed supply chain campaign to simultaneously weaponize npm, PyPI, and Crates.io with execution paths tailored to each runtime: postinstall hooks (npm), import-time remote JS fetch (PyPI), malicious build.rs scripts (Rust/Crates.io). 34 packages, 384+ versions, detected by Socket in under six minutes.

The novel component is the AI coding assistant poisoning. Packages inject .cursorrules and CLAUDE.md files containing zero-width Unicode hidden instructions. When a developer opens the project in Cursor or Claude Code, the assistant reads these configuration files and, following what appear to be legitimate project-level instructions, runs a “security scan” that exfiltrates local secrets. TrapDoor opened pull requests to browser-use/browser-use, langchain-ai/langchain, and langflow-ai/langflow to distribute the poisoned configs upstream. Miasma Wave 2 extended this pattern in June 2026, dropping backdoor configs for Claude Code, Cursor AI, and Google Gemini into project directories alongside the binding.gyp payload.

Miasma Wave 2: Phantom Gyp bypasses every postinstall mitigation

Miasma Wave 2 (June 2–3, 2026) introduced “Phantom Gyp” — a 157-byte binding.gyp file that triggers code execution via node-gyp rebuild shell command expansion. The significance: binding.gyp processing is not a lifecycle script. It bypasses –ignore-scripts, bypasses npm ci –ignore-scripts, and bypasses every conventional lifecycle-script monitor. The payload then downloads the Bun runtime rather than Node.js, bypassing endpoint tools that monitor Node.js process creation specifically.

The campaign deployed 57 packages and 286 malicious versions in under two hours. The binding.gyp file is 157 bytes and identical across all compromised versions (SHA-256: ef641e956f91d501b748085996303c96a64d67f63bfeef0dda175e5aa19cca90), giving defenders a stable hash-based detection signal even though there is no CVE. The –ignore-scripts mitigation, which became the primary recommended response to Shai-Hulud 1.0 in September 2025, was structurally rendered incomplete by June 2026.

What Attackers Impersonate: Typosquat Target Frequency

Frequency of brand or library tokens appearing in malicious package names across the 59-campaign corpus:

TanStack (108 occurrences) and UiPath (67) dominate, displacing the generic utility typosquatting that characterized earlier years. AI-adjacent tooling — Mistral AI, LiteLLM, durabletask — clusters in the top tier. This tells you what developers are reaching for in 2026: modern front-end framework namespaces and the AI/automation tooling around them.

New Techniques Introduced in 2025–2026

Two additional corpus characteristics worth stating plainly: 73 percent of indexed packages carry a pinned malicious version — exact package name plus exact version string — making them blockable as precise IOCs without behavioral detection. 9 of 59 campaigns are cross-ecosystem: TrapDoor hit npm, PyPI, and Crates.io simultaneously; the Shai-Hulud lineage extended into PyPI; Contagious Interview now has confirmed Packagist activity. Attackers no longer specialise in one registry.

The AI Acceleration Layer

The package volume curve and the attacker capability curve are connected. Anthropic’s analysis of 832 accounts banned for violating cyber-related usage policy between March 2025 and March 2026 quantifies the AI contribution. Those accounts used AI models across all 14 MITRE ATT&CK tactics and 482 unique sub-techniques. The share of actors scoring medium risk or higher on the ARiES (AI Risk Enablement Score) framework rose from 33 percent to 56 percent in under a year — a 1.7-fold increase — with growth concentrated in the operational, hands-on-keyboard stages rather than the commodity toolbuilding that dominates the overall count.

Malware development (T1587.001) was used by 560 of 832 accounts — 67.3 percent. That is the commodity layer feeding the registry volume numbers. But the more consequential shift is post-compromise: account discovery (T1087) rose 8.9 percent and automated exfiltration (T1020) rose 6.2 percent across the study year, while phishing fell 8.6 percent and capability development fell 12 percent. Lateral movement was the single strongest predictor of a high-risk actor — the 54 accounts using it averaged a risk score of 56.4 against a population mean of 46.8.

The traditional signals for assessing threat actor risk have stopped working. Technique breadth correlates with risk only weakly (r = 0.27). Interface choice — chat, API, or agentic coding tool — has no bearing on risk, with 80 percent of banned actors using Claude Code, making agentic tooling the statistical default rather than a distinguishing factor. What distinguishes the dangerous actors is scaffolding: the surrounding code and architecture that chains techniques into a continuous, autonomous operation.

The GTG-1002 espionage campaign disrupted in November 2025 scored the maximum 100 on the ARiES framework while using 30 techniques across 13 tactics — a profile comparable to dozens of medium-risk actors in the dataset. The difference was autonomous execution: Claude Code running on a Kali machine with MCP tool integrations scanned internet-facing services, discovered internal portals, exploited an SSRF vulnerability, harvested SSH keys from cloud metadata services, and moved laterally through the victim’s cloud environment, with human input only at the final data extraction step. None of that operational behavior maps to existing ATT&CK IDs. The framework does not yet have taxonomy for autonomous killchain orchestration, real-time pivot decisions, or AI-directed execution.

That MITRE gap matters for defenders of the supply chain specifically. A self-propagating worm that exchanges OIDC tokens, sweeps 130 credential paths, forges backdated commits, drops AI agent configuration hooks, and republishes itself across namespaces is exactly the class of autonomous multi-step operation that has no ID in the framework your threat intelligence team relies on.

Exposure Analysis

Detection Guidance

Log and Host Indicators

• Outbound connections to known C2: 216.126.225.129:8443 (MEGALODON_CI), t.m-kosche[.]com (atool/AntV, actions-cool; disguised OTel collector), zero.masscan[.]cloud:443/v1/telemetry (Mini Shai-Hulud waves), aihao123[.]cn (MaliciousCorgi), flipboxstudio[.]info (Laravel-Lang), ddjidd564.github[.]io (TrapDoor PyPI payload).
• Tor process creation from a CI runner or developer workstation — high confidence IOC for IronWorm.
• Unexpected bun binary in /tmp/bun, ~/bun, or any non-standard path — present in Mini Shai-Hulud, PyTorch Lightning, Miasma Wave 2.
• binding.gyp file in any npm package that does not legitimately use native addons. SHA-256: ef641e956f91d501b748085996303c96a64d67f63bfeef0dda175e5aa19cca90 (Miasma Wave 2; 157 bytes; identical across all 286 malicious versions).
• New .vscode/tasks.json entries with runOn: “folderOpen” combined with reveal: never and echo: false.
• ~/.claude/settings.json SessionStart hooks, CLAUDE.md entries, or .cursorrules files containing zero-width Unicode characters (U+200B, U+200C, U+200D, U+FEFF).
• GitHub repositories newly created under your organization’s developer accounts containing Dune-universe names, the string “Shai-Hulud,” “Miasma: The Spreading Blight,” or reversed-string descriptions.
• Backdated commits authored by claude@users.noreply.github.com, dependabot[bot], renovate[bot], github-actions[bot], ci-bot@automated.dev, or build-system@noreply.dev with timestamps copied from prior legitimate commits.
• GitHub Actions workflow files with base64 decode steps that were not present in the prior committed version.

Scanner References

• Phoenix Security PHX-Neural behavioral engine (77-signal, 94.2% MITRE ATT&CK v16 coverage) scored nicegui@3.12.0 (174,659 weekly downloads) at 100/100 with zero CVEs assigned.
• GitHub code search for MEGALODON_CI injection: query string Q0I9Imh0dHA6Ly8yMTYu.
• Grep for Miasma repository staging: grep -rn “Miasma: The Spreading Blight” across your GitHub organization.
• Grep for Phantom Gyp: grep -rn “binding.gyp” across all npm packages in your lockfile.
• StepSecurity Harden-Runner for CI runner egress detonation evidence.
• SCA and SBOM tooling for lockfile-to-IOC cross-referencing against the Phoenix MPI IOC set.

Verification Steps for Teams

1. Search every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, poetry.lock, composer.lock) against the current Phoenix MPI IOC set — 657 indexed package-versions with exact version pinning in 73 percent of cases.
2. Run behavioral dependency scanning, not CVE-only scanning, across all repositories. CVE scanners had zero detection surface for all 59 documented campaigns.
3. Audit .github/workflows/ across the entire organization for injected base64 decode steps and any workflow_dispatch backdoor triggers added in May 2026.
4. Check all installed VS Code and OpenVSX extensions, including their bundled node_modules dependencies, for tampered packages — the 19-extension Rust trojan wave hid its payload inside path-is-absolute in the extension bundle.
5. Inspect AI agent config files (CLAUDE.md, .cursorrules, settings.json) for zero-width Unicode characters and entries you did not author.
6. Pin all GitHub Actions to full commit SHAs rather than version tags. Both the actions-cool and Megalodon campaigns exploited tag-based reference.
7. Review SBOMs for transitive dependency exposure — worm payloads frequently land through declared transitive dependencies, not the direct package the developer chose.

Enriched Malware Families and the Compromised/Malicious Split

Within the human-enriched layer of the corpus — records carrying Phoenix campaign research attribution — the top malware family by record count is “Multi-stage AI toolchain poisoning.” That is the clearest internal signal of the AI-shift thesis across the entire dataset.

Across the full 465,312-record corpus the offender split is near-even: approximately 238,543 records (51%) are compromised legitimate packages where a maintainer account or pipeline was taken over, versus 226,701 records (49%) of attacker-authored packages published directly. The practical implication for defenders: scanning only for new or unknown packages is not sufficient. More than half the threat surface consists of legitimate, established packages that are now under different control. Exact-version lockfile auditing against known IOCs is the minimum; behavioral detection is required to catch takeovers before they appear in advisory feeds.

Remediation Guidance

Immediate Actions

1. Rotate every credential reachable from any host that ran an affected install or CI job: npm tokens, GitHub PATs, cloud provider keys, Kubernetes configs, SSH keys, and AI provider API keys. IronWorm specifically targets Anthropic, OpenAI, Gemini, Cohere, Mistral, Groq, Perplexity, and xAI credentials.
2. For Miasma Wave 1: remove the gh-token-monitor daemon before revoking GitHub tokens — the malware detects token revocation and can trigger destructive behavior in response.
3. Revoke or re-scope npm OIDC trust federation on any affected namespace. OIDC federation requires no stored token and is the propagation mechanism for Mini Shai-Hulud, IronWorm, and the Bitwarden CLI compromise.
4. Remove all injected lifecycle hooks: .vscode/tasks.json auto-run entries, ~/.claude/settings.json SessionStart hooks, injected .github/workflows/ files. Uninstalling a malicious extension or package does not remove these.
5. Pin dependencies to known-good exact versions and re-resolve lockfiles from a clean state.

Temporary Mitigations

• npm ci –ignore-scripts blocks the postinstall and preinstall delivery mechanism for most of the corpus. State the caveat plainly: Phantom Gyp (binding.gyp) bypasses this flag entirely, and PackageGate (CVE-2025-69263) demonstrated that a malicious .npmrc in a git dependency can override the git binary for full RCE even with the flag set. Behavioral detection is the structural answer; the flag is a partial control.
• Enforce 2FA and trusted publishing across all npm publishing accounts. The PyPI and NuGet malware decline data shows these controls reduce ecosystem volume by 40–60 percent.
• Apply CI runner egress filtering to block unexpected outbound connections. Tor, Solana RPC endpoints, ICP canister endpoints, and unconventional ports are the primary C2 channels in this corpus.
• Adopt pnpm 11+, which enforces a one-day minimum release age before installation — blocking same-day worm propagation.
• Screen IDE extensions before installation. Low download count, recent publication, no reviews, and no clear organizational publisher are the consistent signals across every malicious extension campaign.

Phoenix Security Recommendations

The throughline across all 59 documented campaigns is unchanged: zero CVEs during active exploitation, meaning CVE-based detection had no surface to work with across the entire dataset. Phoenix Security addresses the structural gap.

Behavioral scanning through PHX-Neural evaluates packages on install-time and runtime behavior rather than CVE presence, catching malicious packages before they appear in any advisory feed — as demonstrated by the nicegui detection at 100/100 with zero CVEs.

Contextual deduplication correlates findings across SCA, SBOM, and behavioral scanners into a single prioritized backlog. When a worm cascades through 300 namespaces, that does not produce 300 disconnected tickets.

Reachability analysis identifies which compromised components are actually loaded and executed in runtime environments, separating a package in a lockfile from one running on a credential-bearing CI runner. That distinction is operationally significant: a package in a transitive dependency graph that never executes on a production runner has a different remediation priority than one that fires on every CI build.

Remediation campaigns assign owners by affected service, track fixes, and verify runtime closure — turning an active worm into a bounded, auditable response rather than an unstructured incident. Attack surface management identifies internet-exposed services running affected components so the externally reachable instances get triaged first.

Phoenix correlates compromised packages with the runtime workloads executing them, assigns remediation ownership automatically, and verifies that the exposure has closed — shrinking a 59-campaign, multi-ecosystem threat into an owned remediation backlog.