You have no idea how how bad this really is.

A new wave of npm supply-chain attacks has moved from “possible” harm to real-world credential theft and system damage—largely by abusing npm lifecycle scripts and GitHub Actions CI privileges. The core pattern: attackers publish or inject malicious npm packages that run a stealth pre-install loader, then pivot into CI environments to steal secrets, tamper with networking, and propagate further by using stolen npm tokens.

Earlier npm incidents relied on swapping cryptocurrency-looking strings to make malicious changes harder to notice before a user hits “send,” but those attacks were constrained to specific front-end bundling conditions. This time, the threat is broader and more direct. The most recent campaign involves hundreds of compromised npm packages across many versions, with the malicious code designed to execute during installation—before normal application code even runs.

The mechanism centers on a malicious addition to package.json: a pre-install script named setup_bun.js. That script quietly locates or downloads the Bun runtime for the host platform, caches it, spawns a detached Bun process, and immediately returns while the payload runs in the background. Standard output and errors are suppressed to reduce detection. Because pre-install scripts run automatically during npm install, they effectively turn a dependency update into remote code execution.

Once the payload is running, it performs a multi-stage operation aimed at maximizing access and exfiltration. It searches public GitHub repositories for a specific beacon phrase (“sh1 hood the second coming”) to locate attacker-controlled data. It then decodes a stored GitHub access token using multiple layers of base64, fingerprints the environment to detect CI/CD (including GitHub Actions), and attempts privilege escalation. If it can manipulate sudo/pseudo access, it does; otherwise it tries to exploit Docker-related privileges to gain root.

With elevated access, the malware hijacks DNS and firewall behavior by stopping systemd-resolved, replacing DNS configuration, restarting the resolver, and flushing IP tables. That creates a man-in-the-middle position inside CI, enabling redirection of package downloads to malicious mirrors, blocking security scanners, and interfering with updates.

The payload then harvests high-value data: environment variables (including cloud and API keys), secret material discovered via trufflehog scanning, and cloud secrets from AWS secret managers across regions. It also targets GitHub Actions secrets directly. For exfiltration, it creates a new GitHub repository under the victim’s account using the stolen token, uploads multiple JSON files (system info, environment variables, Azure secrets, trufflehog findings, and GitHub Action secrets), and publishes the repo publicly to make token retrieval easy.

Propagation is automated. The malware looks for npm tokens in CI, uses them to fetch packages from compromised maintainers, updates package versions, injects the malicious pre-install setup, and republishes. A key example cited is Post Hog: the campaign’s spread was not just via a compromised dependency chain; malicious versions were published within Post Hog’s own packages. The transcript also describes an earlier “patient zero” vector tied to Postto Hog’s open-source workflow: an attacker stole a bot’s GitHub token via a malicious pull request against a workflow that ran for external contributors, then used that access to exfiltrate secrets and publish malicious npm packages.

In response, the affected parties are deprecating compromised versions and republishing clean releases. The broader takeaway is that the biggest risk isn’t npm alone—it’s the combination of dynamic code execution (pre/post install scripts) and CI/CD complexity, where small configuration changes (like GitHub Actions pull_request_target triggers) can unintentionally enable remote code execution and secret theft. The practical guidance is immediate: remove known-bad package versions, rotate any exposed credentials, and tighten CI/CD controls to prevent untrusted code from running with access to secrets.