Multiple popular npm packages have been compromised with malware in 2025–2026, including AsyncAPI (2.25 million weekly downloads), @ctrl/tinycolor (2+ million), and Keyv ecosystem packages (500+ million), with payloads that steal credentials and launch botnets. The attacks exploit compromised developer credentials and CI/CD pipeline misconfigurations, enabling self-propagating worms that infect hundreds of additional packages and create cascading compromises across the registry. These incidents reflect a broader trend: Sonatype documented 454,600+ new malicious packages in 2025 alone, representing a 75% year-over-year increase in the malware landscape. The malware executes during package import, not just installation, stealing npm tokens, GitHub credentials, SSH keys, and cryptocurrency wallets before maintaining active remote command-and-control communication.
Table of Contents
- How Did Attackers Compromise These Packages?
- What Do These Malware Payloads Actually Do?
- What Is the Scope of These Compromises?
- What Steps Should Affected Users Take?
- Why Is Supply Chain Security Hard to Fix?
- Frequently Asked Questions
How Did Attackers Compromise These Packages?
Compromised maintainer credentials are the primary attack vector. Attackers obtained developer GitHub accounts through phishing or credential theft, then used repository write permissions to inject malware directly into package source code and publish poisoned versions. In the AsyncAPI case, attackers exploited GitHub Actions misconfigurations to automate malware injection with valid CI/CD signatures that appeared legitimate.
Once malware infects a developer's system, credential theft enables secondary compromise waves. The malware steals npm tokens and GitHub authentication from initial victims, giving attackers legitimate access to additional packages and accounts. This creates a cascading effect: each newly compromised maintainer provides credentials that unlock more packages, exponentially expanding the infection.
What Do These Malware Payloads Actually Do?
AsyncAPI malware downloads a botnet framework from IPFS and steals credentials including npm tokens, GitHub tokens, SSH keys, and cryptocurrency wallets while maintaining active C2 communication. Critically, the payload executes when the package is *imported*, not installed—meaning developers running the malicious code may not realize it until damage has occurred.
Other campaigns go further. Axios (March 2026) delivered a cross-platform remote access trojan to 100+ million weekly downloads, granting attackers direct control over affected systems. The @ctrl/tinycolor worm contained functions that automatically downloaded tarballs, injected malicious scripts, repacked archives, and republished poisoned versions to npm without human intervention—enabling autonomous spread across the ecosystem.
What Is the Scope of These Compromises?
The largest recent incident, the Keyv ecosystem attack (August 2026), compromised packages totaling 500+ million weekly downloads and spreading to hundreds of additional packages, reaching over 2 billion monthly installs ecosystem-wide. Individual incidents span different scales but all affect millions of developers: AsyncAPI's 2.25 million, @ctrl/tinycolor's 2+ million, and Axios's 100+ million weekly downloads represent the ecosystem's most-critical infrastructure.
The malware growth trajectory shows this is not a one-off event. The ecosystem blocked over 1.233 million cumulative malicious packages by 2026, with 454,600 new detections in 2025 alone—a 75% increase year-over-year. Each month brings new compromises because the attack surface is enormous: developers need only one credential slip or phishing email to give attackers a foothold in widely-used packages.
What Steps Should Affected Users Take?
After malware removal, organizations must regenerate all compromised credentials, regenerate lock files, audit developer workstations for persistence, and verify production deployments. The remediation burden is substantial because malware can steal multiple credential types (npm, GitHub, SSH, AWS, crypto wallets) and maintain persistence through backdoored dependencies. Immediate actions include: Long-term, enable 2FA on GitHub and npm accounts, use ecosystem security tools like lockfile verification, and monitor npm for new versions of packages you depend on.
- Rotate all npm tokens, GitHub personal access tokens, and SSH keys
- Review GitHub Actions logs and repository audit trails for unexpected commits or publishes
- Audit npm package history for unexpected version bumps or timestamp anomalies
- Run security scanners on developer machines and production systems for additional malware
- Regenerate `package-lock.json` or `yarn.lock` from a known-clean state
Why Is Supply Chain Security Hard to Fix?
npm's trust model relies on individual maintainers' credentials—when one person's password or token is stolen, thousands of dependent projects are at risk. The registry has no automated way to verify that a published version came from legitimate code rather than injected malware, so even packages with valid CI/CD signatures can be weaponized if the developer account is compromised.
Mitigations like lockfile pinning, signed commits, and provenance verification help reduce the window of exposure but cannot eliminate the risk entirely. A developer with a stolen token can publish malicious code immediately, and detection is reactive—the malware must be discovered and removed before developers update. This means your organization's real security depends on rapid incident response, robust credential management, and the ability to quickly audit and rotate secrets when a compromise occurs.
Frequently Asked Questions
How do I know if my project was affected?
Check your `package-lock.json` or `yarn.lock` for versions of AsyncAPI, Keyv, @ctrl/tinycolor, or Axios published between the compromise dates. OX Security and Microsoft Security Blog provide detailed timeline and version information. npm's security advisories also list affected version ranges.
Can I just update to the patched version?
Updating stops future malware injection but does not remove malware already present on developer machines or in production systems. You must also rotate credentials and audit systems that imported the malicious versions.
What if I'm a package maintainer?
Enable 2FA on GitHub and npm, use a dedicated SSH key for package publishing, rotate credentials regularly, and audit your GitHub Actions workflows for overly broad permissions. Report any suspicious access to npm and GitHub immediately.