npm Resets Publishing Tokens After Critical 2FA Bypass Vulnerability

Key Takeaways

• npm initiated a platform-wide reset of all granular access tokens with write access that bypassed two-factor authentication, effective May 19.
• The action was a direct response to the “Mini Shai-Hulud” supply chain attack campaign, which compromised hundreds of npm packages and even led to a GitHub internal repository breach.
• Attackers leveraged stolen credentials and sophisticated exploits to publish malicious package versions and exfiltrate data at an alarming scale and speed.
• npm also launched Staged Publishing, a new security feature requiring MFA-verified approval for automated releases, to mitigate similar future attacks.

npm Responds to Critical 2FA Bypass Vulnerability with Token Reset

In a significant move to counter ongoing supply chain attacks, the npm registry implemented an urgent, platform-wide security measure last week. On May 19, npm invalidated all granular access tokens that possessed write permissions and bypassed two-factor authentication (2FA). This critical action necessitates that maintainers generate new credentials and update all automated workflows to restore functionality.

This widespread token reset was a direct consequence of the “Mini Shai-Hulud” campaign, a coordinated threat that has been actively exploiting vulnerabilities within the JavaScript ecosystem for nearly a month.

The Mini Shai-Hulud Attack Campaign

The immediate catalyst for the mass token invalidation occurred on May 18, when threat actors successfully compromised a legitimate npm maintainer account named “atool.” Utilizing this hijacked account, attackers rapidly published 639 malicious package versions across 323 distinct packages in a single, automated surge.

This malicious wave heavily impacted the @antv data-visualization ecosystem, affecting widely used packages such as echarts-for-react, which boasts approximately 1.1 million weekly downloads, alongside timeago.js, size-sensor, and canvas-nest.js. The attack’s speed and scale left minimal opportunity for immediate defensive reactions.

Researchers at Socket.dev, in a report shared with Cyber Security News (CSN), revealed that the Mini Shai-Hulud campaign had been operational for three weeks prior to this incident. They noted that the @antv breach followed an earlier compromise on May 11 of 42 TanStack npm packages, including @tanstack/react-router, which has 12 million weekly downloads.

Socket’s tracking identified 1,055 compromised versions across 502 unique packages spanning npm, PyPI, and Composer registries. The group behind these attacks has been attributed to a threat actor known as TeamPCP.

The campaign’s reach extended beyond npm packages. GitHub disclosed that attackers exfiltrated approximately 3,800 of its internal repositories. The entry point for this breach was traced to Nx Console, a VS Code extension with 2.2 million installations. Attackers had stolen credentials from an Nx maintainer during the TanStack compromise and subsequently used them to publish a poisoned build of the extension. Although this malicious version was available on the Visual Studio Marketplace for only 18 minutes before its takedown, it was sufficient time for the attackers to deliver credentials that granted them access to GitHub’s internal systems.

Understanding the Mini Shai-Hulud Attack Mechanics

The core strategy of Mini Shai-Hulud revolves around stealing developer tokens used for package publishing, then leveraging these tokens to push poisoned versions of every package maintained by the victim. The worm scans developer machines and CI environments for npm credentials. Granular access tokens that bypass 2FA are particularly vulnerable due to their long-lived nature and storage in secret stores, making them prime targets. Once harvested, the worm automatically republishes malicious versions, effectively transforming each compromised account into a launchpad for further infections.

Notably, some of the campaign’s most damaging actions did not even require stolen tokens. The attackers targeting TanStack employed a sophisticated chained exploit involving a Pwn Request attack, GitHub Actions cache poisoning, and real-time extraction of an OIDC token from a runner’s process memory. Similarly, the Bitwarden CLI compromise on April 23 resulted from directly infecting the project’s publish-ci.yml workflow. Both of these attacks successfully bypassed Trusted Publishing, a control npm now recommends as a primary defense for the broader ecosystem.

npm’s Staged Publishing and Recommendations for Maintainers

Alongside the immediate token reset, npm also introduced a more strategic, long-term security enhancement: Staged Publishing. This feature entered public preview on May 20, following the merger of the npm stage command into CLI v11.15.0. Under this new model, automated CI publishes are routed through a staging area. A maintainer must then approve the release with an MFA-verified step before it becomes publicly available to users. This mechanism ensures that even if an attacker manages to push a malicious version using stolen credentials, the release will be halted at the staging gate, awaiting human review and approval.

Security researcher Adnan Khan has urged all npm maintainers to enable Staged Publishing without delay, characterizing it as a direct countermeasure to the Shai-Hulud campaign. npm creator Isaac Schlueter has further advocated for GitHub, npm, and Microsoft to completely disable non-MFA publishing across the entire ecosystem.

Maintainers whose pipelines were disrupted by the token reset are advised to generate new granular tokens. Furthermore, they should rotate every credential that the affected environment could have accessed, including GitHub tokens, AWS, GCP, and Azure credentials, SSH keys, Kubernetes tokens, Vault tokens, Stripe keys, and AI configuration files such as .claude/settings.json.

What You Should Do

• Generate New Granular Tokens: Immediately invalidate any existing granular access tokens with write permissions that bypass 2FA and generate new ones.
• Enable Staged Publishing: For all automated CI/CD workflows, implement npm’s new Staged Publishing feature (CLI v11.15.0 or later) to require MFA-verified human approval before releases go live.
• Rotate All Related Credentials: Beyond npm tokens, rotate all credentials that could have been exposed in compromised environments, including cloud provider keys (AWS, GCP, Azure), GitHub tokens, SSH keys, Kubernetes tokens, Vault tokens, and any AI configuration files (e.g., .claude/settings.json).
• Review CI/CD Workflows: Scrutinize CI/CD workflow files (e.g., publish-ci.yml) for any unauthorized modifications or suspicious activity.
• Implement Strong MFA: Ensure robust multi-factor authentication is enabled for all developer accounts and critical services.
• Monitor for IoCs: Refer to the provided Indicators of Compromise (IoCs) to check for any signs of compromise within your projects and infrastructure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.