Listen to this Post
Introduction
A newly uncovered supply chain attack against the npm ecosystem has exposed just how dangerous modern developer-focused malware campaigns have become. Security researchers at Microsoft revealed that a threat actor operating under the alias “vpmdhaj” launched a coordinated attack using 14 malicious npm packages designed to impersonate trusted OpenSearch, ElasticSearch, and DevOps-related libraries.
The campaign was highly targeted, technically sophisticated, and clearly engineered for maximum impact against cloud-native environments. The malware focused heavily on stealing sensitive credentials from Amazon Web Services, HashiCorp Vault, GitHub Actions, npm publishing accounts, and CI/CD infrastructure. Even more alarming, the malicious packages executed automatically during installation, meaning developers did not need to run the imported package manually for the compromise to begin.
The attack demonstrates how modern supply chain compromises are evolving beyond simple malware delivery into multi-stage cloud credential theft operations capable of enabling lateral movement across enterprise environments. Microsoft confirmed that the malicious packages and maintainer accounts were eventually removed after investigation and coordination with the npm security team.
A Coordinated Supply Chain Operation
According to Microsoft’s investigation, the attacker published all 14 malicious packages within a four-hour period on May 28, 2026. The packages were carefully crafted to resemble legitimate OpenSearch and ElasticSearch tools commonly used by developers and DevOps engineers.
Names such as “opensearch-setup,” “elastic-opensearch-helper,” “search-engine-setup,” and “env-config-manager” were intentionally designed to trick developers into believing they were official or community-supported utilities.
The campaign relied heavily on typosquatting techniques. The malicious packages also spoofed metadata fields inside package.json files, including repository URLs, homepage links, and bug tracking references pointing toward the legitimate OpenSearch GitHub project. This significantly increased the likelihood that developers would trust and install the packages.
To make the fake packages appear mature and established, the attacker assigned suspiciously large version numbers like 1.0.9108 and 2.1.9201, creating the illusion of long development histories and active maintenance.
Automatic Malware Execution During npm Install
One of the most dangerous aspects of the campaign was its abuse of npm lifecycle hooks. Every package contained preinstall, install, or postinstall scripts that executed automatically when the victim ran npm install.
This meant the infection process began immediately without requiring developers to import or execute the package in application code.
Microsoft observed two generations of malware loaders:
Gen-1 Loader Design
The first generation used a classic HTTP command-and-control structure. During installation, the malicious script collected extensive information from the victim machine including:
Hostname
Operating system
CPU architecture
Node.js version
Current working directory
Username
npm package metadata
This data was encoded and sent to an attacker-controlled server using a unique “X-Supply: 1” HTTP header.
The server then responded with a compressed second-stage payload which was saved as “payload.bin,” marked executable, and launched in detached mode.
Even worse, the malware persisted across rebuilds and CI stages because the package’s index.js automatically relaunched the payload every time the module was imported.
Gen-2 Loader Became Far More Stealthy
The second-generation attack evolved into a far stealthier operation.
Instead of downloading the payload directly from a command-and-control server, the malware abused the legitimate Bun JavaScript runtime. If Bun was not installed on the host system, the malicious setup script downloaded the official Bun runtime directly from GitHub releases for the correct operating system and architecture.
The malware then unpacked and executed a pre-bundled credential stealing payload hidden inside the npm package itself.
This design drastically reduced suspicious outbound traffic during installation, making detection far more difficult for defenders relying on network monitoring.
The attackers essentially weaponized a legitimate developer tool as part of the malware delivery chain.
Credential Theft Across Cloud Infrastructure
The second-stage payload focused almost entirely on cloud credential theft and CI/CD compromise.
Microsoft discovered the malware targeted several major platforms simultaneously:
AWS Credential Theft
The malware queried AWS EC2 Instance Metadata Service v2 and ECS task metadata endpoints to steal temporary credentials from cloud workloads.
It also attempted to:
Enumerate AWS Secrets Manager across more than 16 regions
Execute STS GetCallerIdentity requests
Abuse AssumeRole permissions
Read environment-based AWS credentials
This allowed attackers to pivot laterally inside cloud infrastructure and potentially access sensitive production secrets.
HashiCorp Vault and GitHub Actions Targeted
The malware actively searched for Vault authentication tokens stored inside environment variables including:
VAULT_TOKEN
VAULT_AUTH_TOKEN
It also harvested GitHub Actions metadata to identify CI/CD runners and build environments that could be exploited further.
The malware specifically collected:
GITHUB_REPOSITORY
RUNNER_OS
This suggests the campaign was optimized for compromising software build pipelines and developer environments.
npm Publish Token Theft Raises Serious Concerns
Perhaps the most dangerous capability involved npm publish token theft.
The malware validated npm credentials using the npm whoami endpoint and enumerated publishing permissions associated with compromised accounts.
This created the possibility of downstream supply chain attacks where attackers could hijack legitimate npm maintainers and push malicious updates into trusted packages already used across thousands of applications worldwide.
This turns a single compromised developer workstation into a potential launch point for a much larger ecosystem-wide attack.
Bun Runtime Abuse Marks a Dangerous Trend
One of the most interesting technical details in the report is the attacker’s use of Bun.
Bun itself is not malicious. It is a legitimate high-performance JavaScript runtime increasingly popular among developers. However, the attackers cleverly used Bun as a trusted execution environment to hide malicious payloads and bypass detection systems that focus primarily on Node.js behavior.
This reflects a growing trend in modern cyberattacks where threat actors increasingly abuse trusted open-source tools, cloud APIs, and legitimate runtimes instead of deploying obviously malicious binaries.
Security tools that only look for traditional malware signatures may struggle against this type of hybrid attack.
Deep Analysis
Supply Chain Attacks Are Becoming Cloud-Native
This campaign highlights a major shift in the cyber threat landscape.
Older supply chain attacks often focused on stealing browser cookies, cryptocurrency wallets, or personal credentials. This operation was clearly designed for cloud-native infrastructure compromise.
The malware aggressively targeted:
AWS environments
Secrets management systems
CI/CD pipelines
npm publishing accounts
GitHub automation infrastructure
This indicates the attackers understood modern DevOps workflows in detail.
The focus on AWS metadata services and GitHub Actions strongly suggests the campaign targeted organizations running automated deployment pipelines and cloud-first architectures.
CI/CD Systems Are Now Prime Targets
CI/CD systems have become one of the most valuable targets for attackers because compromising a build pipeline can grant indirect access to production environments, application secrets, internal repositories, and customer infrastructure.
If attackers obtain GitHub Actions tokens combined with AWS AssumeRole permissions, they can potentially move from a developer environment directly into cloud infrastructure.
This is why modern supply chain attacks increasingly prioritize build systems over end-user machines.
Typosquatting Still Works Extremely Well
Despite years of warnings, typosquatting remains highly effective.
Developers frequently install packages quickly without verifying maintainers, repository URLs, download history, or source authenticity.
Attackers exploit this behavior by creating packages with names that appear legitimate at first glance.
The addition of spoofed GitHub repository metadata made this campaign especially convincing because many developers rely on repository links as trust indicators.
npm Lifecycle Hooks Continue to Be Dangerous
The abuse of npm preinstall and postinstall scripts remains one of the largest security weaknesses in the JavaScript ecosystem.
Most developers still underestimate the risk associated with automatic install-time execution.
The malware required no application execution and no explicit import statement. Simply installing the dependency triggered the compromise.
Organizations relying heavily on npm packages should strongly consider disabling install scripts by default wherever operationally possible.
The Bun Loader Shows Increasing Attacker Sophistication
The transition from the Gen-1 HTTP beacon approach to the stealthier Bun-based loader shows rapid operational adaptation.
The attackers clearly understood that defenders monitor suspicious outbound connections during installation.
By bundling the payload locally and using the legitimate Bun runtime, they significantly reduced network-based detection opportunities.
This reflects professional operational security practices more commonly associated with advanced persistent threat groups.
Open Source Ecosystems Face Growing Trust Problems
This incident also exposes a broader issue affecting open-source ecosystems.
Package repositories rely heavily on implicit trust and decentralized publishing models. Attackers understand that compromising a single package can potentially impact thousands of organizations simultaneously.
The software supply chain is now one of the most attractive attack surfaces in cybersecurity because developers automatically import and execute third-party code at massive scale.
As dependency chains continue growing, organizations will need stronger package verification, dependency auditing, and runtime isolation strategies.
Commands and Codes Related to the
Disable npm lifecycle scripts globally
npm config set ignore-scripts true
Install packages without executing scripts
Bash
npm install --ignore-scripts
Hunt for suspicious Bun downloads
kusto
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("node.exe", "node")
| where RemoteUrl has "github.com/oven-sh/bun/releases/download"
Detect suspicious payload execution
kusto
DeviceProcessEvents
| where ProcessCommandLine has "__DAEMONIZED=1"
Hunt for malicious npm packages
Bash
npm ls | grep opensearch
Check for suspicious AWS metadata access
kusto
DeviceNetworkEvents
| where RemoteIP in ("169.254.169.254", "169.254.170.2")
What Undercode Say:
The vpmdhaj campaign represents one of the clearest examples yet of how software supply chain attacks are evolving into cloud-focused espionage operations rather than traditional malware infections.
What makes this campaign especially dangerous is not simply the use of malicious npm packages, but the attacker’s deep understanding of modern developer workflows. The malware did not randomly search for credentials. It specifically hunted AWS IAM tokens, Vault secrets, GitHub Actions metadata, npm publish access, and CI/CD execution environments. That level of targeting indicates strategic intent rather than opportunistic credential theft.
Another critical detail is the operational maturity shown by the attackers. Publishing 14 coordinated packages within hours, spoofing legitimate OpenSearch repositories, inflating version numbers, and later transitioning toward a stealthier Bun-based execution chain demonstrates disciplined infrastructure planning.
The Bun abuse is particularly important. Security products often classify runtimes like Bun, Node.js, Python, or PowerShell as trusted developer tools. Threat actors increasingly leverage that trust to bypass behavioral detections. This mirrors trends already seen with attackers abusing Docker, Terraform, Kubernetes tooling, and GitHub Actions themselves.
The campaign also demonstrates why CI/CD infrastructure has become one of the most valuable targets in cybersecurity. Modern organizations often store deployment secrets, cloud credentials, API keys, signing certificates, and internal repository access directly inside automation systems. Compromising a single build runner may effectively compromise an entire production environment.
The npm ecosystem continues facing systemic trust issues as package counts explode into the millions. Developers routinely install dependencies without carefully reviewing maintainers or inspecting install-time behavior. Attackers understand this and increasingly exploit developer speed and convenience culture.
Microsoft’s recommendation to disable lifecycle scripts where possible is technically sound, but many enterprise environments still depend heavily on install hooks for legitimate package functionality. That creates a difficult balance between security and operational compatibility.
Another major concern is downstream supply chain pivoting. Stolen npm publish tokens allow attackers to compromise legitimate packages trusted by thousands of developers. This transforms a relatively small infection into a potentially ecosystem-wide incident.
The use of AWS metadata service theft also suggests attackers are increasingly prioritizing ephemeral credentials over static secrets. Cloud-native infrastructure often assumes temporary tokens are safer, but malware running locally can still steal them directly from memory or metadata endpoints.
This attack should serve as a wake-up call for organizations relying heavily on JavaScript ecosystems and automated cloud deployments. Dependency trust can no longer be assumed by default.
Zero Trust principles must now extend into package management, CI/CD workflows, runtime behavior monitoring, and developer workstation security.
Fact Checker Results
✅ Microsoft publicly documented a coordinated npm supply chain attack involving 14 malicious packages tied to the vpmdhaj maintainer alias.
✅ The malware specifically targeted AWS credentials, HashiCorp Vault tokens, npm publish tokens, and GitHub Actions environments through automated install-time execution.
❌ There is currently no public evidence directly linking the vpmdhaj operation to a known nation-state or advanced persistent threat group.
Prediction
Software supply chain attacks targeting npm, PyPI, and container ecosystems will increase dramatically over the next two years.
More attackers will begin abusing legitimate developer runtimes like Bun, Deno, and Docker to bypass traditional endpoint detections.
Organizations that continue allowing unrestricted install-time scripts inside CI/CD pipelines will face significantly higher compromise risks.
npm ecosystems may experience larger downstream attacks if stolen publish tokens from campaigns like this are later weaponized against trusted packages.
Cloud-native security monitoring focused on metadata service abuse and secrets enumeration will become a standard enterprise defense requirement.
🕵️📝Let’s dive deep and fact‑check.
References:
Reported By: www.microsoft.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
