The npm Threat Landscape: Attack Surface and Mitigations

The npm ecosystem, particularly since the September 2025 Shai-Hulud worm incident, has become a high-consequence threat landscape with an aggressive acceleration in supply chain compromises. Attacks have evolved from simple typosquatting to systematic campaigns employing wormable propagation, infrastructure-level persistence, and multi-stage payloads. The article details a recent Shai-Hulud-related campaign by TeamPCP, illustrating its sophisticated credential harvesting, exfiltration, and npm worm propagation techniques, and provides guidance for mitigation and protection.