Listen to this Post
Introduction: When Trusted Defenses Quietly Fail
For years, the JavaScript ecosystem believed it had learned its lesson. After devastating supply chain attacks shook npm and its vast dependency network, developers embraced a simple but reassuring security mantra: disable lifecycle scripts and lock dependencies tightly with lockfiles. It sounded practical, almost foolproof. But new research shows that this confidence may have been dangerously misplaced. A set of vulnerabilities now known as PackageGate reveals that even the most widely recommended safeguards can be bypassed, reopening the door to silent, deeply embedded attacks across modern JavaScript projects.
PackageGate and the Illusion of Safety in JavaScript Supply Chains
Security researchers at Koi Security uncovered a group of critical vulnerabilities, collectively tracked as PackageGate, affecting popular JavaScript package managers including npm, pnpm, vlt, and Bun. These flaws allow attackers to execute malicious code even when developers follow industry best practices such as disabling install scripts and relying on lockfiles to ensure dependency integrity. The findings directly challenge the defensive model adopted after previous large-scale npm supply chain compromises.
How Post-Attack Defenses Were Supposed to Work
After incidents like the Shai-Hulud attack, which compromised hundreds of npm packages, the JavaScript community rallied around two core protections. The first was disabling lifecycle scripts using flags like –ignore-scripts, preventing arbitrary code execution during installation. The second was strict use of lockfiles, ensuring dependencies remained pinned to reviewed versions. In theory, this combination should have neutralized most supply chain attacks.
Six Zero-Day Vulnerabilities Break the Model
Koi researchers tested major package managers and discovered six zero-day vulnerabilities that bypass both script blocking and lockfile enforcement. These flaws affect npm, pnpm, vlt, and Bun, enabling attackers to execute code in environments that were assumed to be secure. While pnpm, vlt, and Bun responded quickly and issued fixes, npm classified the findings as expected behavior rather than security issues, leaving users exposed.
Git Dependencies as an Unexpected Attack Vector
One of the most severe PackageGate techniques abuses git-based dependencies. Attackers can embed a malicious .npmrc file inside a dependency, redefining the git binary to point to attacker-controlled code. When npm processes nested git dependencies, it unknowingly executes the malicious script instead of the legitimate git binary. This results in full remote code execution, even with –ignore-scripts enabled.
Silent Execution Across Different Package Managers
Each package manager revealed its own unique weakness. pnpm, despite disabling scripts by default, still runs prepare scripts during git fetch operations, allowing malicious code to execute quietly. vlt was vulnerable to path traversal attacks within tarballs, enabling attackers to overwrite critical files such as the git binary for later exploitation. Bun relied on package name trust rather than source verification, allowing attackers to reuse trusted names to execute scripts without suspicion.
Lockfiles Fail Under Targeted Attacks
The research also exposed a critical flaw in lockfile trust. pnpm and vlt accept remote tarballs without enforcing integrity hashes, meaning attackers can modify package contents after initial review. This allows for targeted payload delivery based on timing, IP address, or other environmental signals. In such cases, the lockfile offers no real protection against malicious updates.
Evidence of Real-World Exploitation
These risks are not theoretical. Koi cited PhantomRaven, a malicious campaign detected in October, which used remote dependency delivery to hide malware from npm scanners. The campaign successfully gained more than 86,000 downloads while remaining invisible to traditional security tooling. This demonstrates how PackageGate-style attacks can evade detection at scale.
Disclosure, Responses, and a Divided Ecosystem
Koi responsibly disclosed the PackageGate vulnerabilities to all affected package managers. pnpm, vlt, and Bun addressed the issues within weeks. npm, however, closed the report, stating that users are responsible for vetting dependencies, despite listing such issues as in-scope within its own bug bounty program. After repeated unanswered attempts to re-engage npm, the researchers chose public disclosure so organizations could assess their exposure.
What Undercode Say:
The PackageGate revelations expose a deeper structural problem in the JavaScript supply chain, one that goes beyond individual bugs or misconfigurations. The ecosystem has leaned too heavily on procedural defenses, assuming that flags and files can compensate for systemic trust issues. Disabling scripts and pinning versions were never meant to be absolute safeguards, yet they became treated as such.
What stands out most is not the existence of bypasses, but how quietly they operate. These attacks do not rely on noisy exploits or obvious red flags. They blend into normal dependency resolution workflows, executing code at moments developers rarely inspect. That makes them especially dangerous in large organizations where dependency trees span thousands of packages and human review is impossible.
npm’s response is particularly concerning. By framing these behaviors as expected, it effectively shifts the burden of supply chain security entirely onto end users, despite the platform’s central role in dependency distribution. This stance undermines trust and creates an uneven security landscape where safer defaults depend on which package manager a team chooses.
The rapid fixes from pnpm, vlt, and Bun highlight that mitigation is possible when maintainers treat supply chain abuse as a first-class threat. But even with patches, the underlying lesson remains clear. Supply chain security cannot rely on static assumptions. Attackers adapt quickly, exploiting gray areas between features and trust boundaries.
Organizations must rethink their threat models. Dependency inclusion should be treated as code execution, not configuration. Network-based verification, stricter source validation, reproducible builds, and behavioral monitoring during installs are becoming necessities rather than optional hardening steps. PackageGate is not just a vulnerability cluster, it is a warning that the JavaScript ecosystem’s security model needs a serious evolution.
Fact Checker Results
✅ PackageGate vulnerabilities were confirmed by Koi Security and responsibly disclosed.
✅ Multiple package managers acknowledged and fixed critical flaws.
❌ Lockfiles and script disabling alone are not sufficient defenses.
Prediction
📊 Package managers will move toward stricter source verification and reproducible installs.
📊 Supply chain attacks will increasingly use targeted, time-based payload delivery.
📊 Developers will favor ecosystems that enforce security by default, not by convention.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.instagram.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
