npm under siege (what to do about it) (Friends)
Episode
95 min
Read time
2 min
Topics
Fundraising & VC, Leadership, Artificial Intelligence
AI-Generated Summary
Key Takeaways
- ✓Attack Scale: Over 1,700 confirmed typosquatting attacks detected in three years, with recent compromises affecting packages receiving 2-3 billion weekly downloads including Prettier, NX, and multiple Sindre Sorhus packages. Attackers stole approximately $500 in cryptocurrency despite massive reach, showing poor execution despite sophisticated access.
- ✓GitHub Actions Vulnerability: Attackers exploited pull_request_target trigger instead of pull_request in workflow files, combined with shell injection bugs, to steal NPM tokens from old branches. This perpetual vulnerability exists because historical GitHub Actions remain executable indefinitely through pull requests against archived branches, requiring manual GitHub support intervention to remove.
- ✓AI-Powered Malware: NX compromise used Claude and Gemini CLI tools with English prompts to scan file systems for sensitive data, triple base64-encoding stolen credentials to evade detection. This novel technique bypasses traditional pattern-matching security tools by using natural language instructions instead of recognizable malicious code patterns.
- ✓PNPM Delay Protection: Configure minimum_release_age setting to reject packages published within seven days, providing time for security vendors to detect malware before installation. This one-line configuration change offers significant protection against noisy attacks typically caught within hours or days, with override options for urgent security patches.
- ✓Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers without API keys or rate limits, blocking malicious dependencies in real-time during development workflows.
What It Covers
NPM faces unprecedented supply chain attacks in 2025, with billions of weekly downloads compromised through phishing, GitHub Actions exploits, and AI-powered malware. Socket Security's Feraz explains attack vectors, detection methods, and introduces Socket Firewall for real-time protection.
Key Questions Answered
- •Attack Scale: Over 1,700 confirmed typosquatting attacks detected in three years, with recent compromises affecting packages receiving 2-3 billion weekly downloads including Prettier, NX, and multiple Sindre Sorhus packages. Attackers stole approximately $500 in cryptocurrency despite massive reach, showing poor execution despite sophisticated access.
- •GitHub Actions Vulnerability: Attackers exploited pull_request_target trigger instead of pull_request in workflow files, combined with shell injection bugs, to steal NPM tokens from old branches. This perpetual vulnerability exists because historical GitHub Actions remain executable indefinitely through pull requests against archived branches, requiring manual GitHub support intervention to remove.
- •AI-Powered Malware: NX compromise used Claude and Gemini CLI tools with English prompts to scan file systems for sensitive data, triple base64-encoding stolen credentials to evade detection. This novel technique bypasses traditional pattern-matching security tools by using natural language instructions instead of recognizable malicious code patterns.
- •PNPM Delay Protection: Configure minimum_release_age setting to reject packages published within seven days, providing time for security vendors to detect malware before installation. This one-line configuration change offers significant protection against noisy attacks typically caught within hours or days, with override options for urgent security patches.
- •Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers without API keys or rate limits, blocking malicious dependencies in real-time during development workflows.
Notable Moment
An attacker successfully compromised the NX build system by opening a pull request against a two-year-old branch containing a previously fixed GitHub Actions vulnerability. This revealed that security fixes in workflow files cannot truly be patched because historical branches remain exploitable indefinitely through the pull request mechanism.
Episode Transcript
Welcome to Change Log and Friends, a weekly talk show about exfiltrating claud tokens. Thank you to our sponsors at fly.io, the public cloud built for developers who like to ship. We love Fly. You might too. Check them out at fly.io. Okay. Let's talk. What's up, friends? I'm here with Kyle Galbraith, cofounder and CEO of Deepo. Deepo is the only build platform looking to make your builds as fast as possible. But, Kyle, this is an issue because GitHub Actions is the number one CI provider out there, but not everyone's a fan. Explain that. I think when you're thinking about GitHub Actions, it's really quite jarring how you can have such a wildly popular CI provider, and yet it's lacking some of the basic functionality or tools that you need to actually be able to debug your builds or deployments. And so back in June, we essentially took a stab at that problem in particular with Depot's GitHub Action runners. What we've observed over time is effectively GitHub Actions, when it comes to, like, actually debugging a build, is pretty much useless. The job logs in GitHub Actions UI is pretty much where your dreams go to die. Like, they're collapsed by default. They have no resource metrics. When jobs fail, you're essentially left playing detective, like, clicking each little drop down on each step in your job to figure out, like, okay, where did this actually go wrong? And so what we set out to do with our own GitHub Actions observability is essentially we built a real observability solution around GitHub Actions. Okay. So how does it work? All of the logs by default for a job that runs on a depot GitHub Action runner, they're uncollapsed. You can search them. You can detect if there's been out of memory errors. You can see all of the resource contention that was happening on the runner. So you can see your CPU metrics, your memory metrics, not just at the top level runner level, but all the way down to the individual processes And so for us, this is our take on the first step forward of actually building a real observability solution around GitHub Actions so that developers have real debugging tools to figure out what's going on in their builds. Okay, friends. You can learn more at depot.dev. Get a free trial, test it out, instantly make your builds faster. So cool. Again, depot.dev. Today, we are joined by our old friend Faraz from Socket Security. I don't know. Faraz, is there security stuff even to do these days? I mean, it's all pretty locked down, isn't it? Yeah. Not much is going on. It's been really quiet, out on NPM. You know, a lot a lot of just nice people publishing nice packages. Nothing to report, really. I try to keep up with, like, hacks and cracks and, like, what's going on broadly in the security space because I find it interesting. I …
Get the full transcript (19,308 words) + summary by email — free
One-time email with the complete transcript and AI summary of this episode. No account needed.
One email, no spam. We’ll also show you what SignalCast does.
You just read a 3-minute summary of a 92-minute episode.
Get The Changelog summarized like this every Monday — plus up to 2 more podcasts, free.
Pick Your Podcasts — FreeKeep Reading
More from The Changelog
Forking Cal.com to closed source (Interview)
Sep 3 · 114 min
Software Engineering Daily
Blocking Software Supply Chain Attacks with Feross Aboukhadijeh
Dec 9
More from The Changelog
Postgres at PlanetScale (Interview)
Aug 25 · 102 min
Machine Learning Street Talk
AI Agents Can Code 10,000 Lines of Hacking Tools In Seconds - Dr. Ilia Shumailov (ex-GDM)
Oct 4
Books, tools, and gear mentioned in this episode
SignalCast may earn commission on purchases via these links.
Tools
by Google
“AI-Powered Malware: NX compromise used Claude and Gemini CLI tools with English prompts to scan file systems for sensitive data.”
“Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers.”
“Over 1,700 confirmed typosquatting attacks detected in three years, with recent compromises affecting packages receiving 2-3 billion weekly downloads including Prettier, NX, and multiple Sindre Sorhus packages.”
“Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers.”
“Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers.”
“Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers.”
“Over 1,700 confirmed typosquatting attacks detected in three years, with recent compromises affecting packages receiving 2-3 billion weekly downloads including Prettier, NX, and multiple Sindre Sorhus packages.”
by Socket Security
“Socket Firewall Launch: New free tool (sfwpm install) routes package installations through local firewall checking for malware before allowing downloads. Works across NPM, Yarn, PNPM, Cargo, and Python package managers.”
company
“💼 SPONSORS ["name": "Depot"]”
“Socket Security's Feraz explains attack vectors, detection methods, and introduces Socket Firewall for real-time protection.”
“💼 SPONSORS ["name": "Fly.io"]”
More from The Changelog
We summarize every new episode. Want them in your inbox?
Forking Cal.com to closed source (Interview)
Postgres at PlanetScale (Interview)
Canary tokens and digital tripwires (Interview)
From open source hits to OpenAI (Interview)
MCP on Code Mode (Interview)
Similar Episodes
Related episodes from other podcasts
Software Engineering Daily
Dec 9
Blocking Software Supply Chain Attacks with Feross Aboukhadijeh
Machine Learning Street Talk
Oct 4
AI Agents Can Code 10,000 Lines of Hacking Tools In Seconds - Dr. Ilia Shumailov (ex-GDM)
Software Engineering Daily
Aug 4
AI-Powered Threats to the Software Supply Chain
Pivot
Mar 13
Iran War Oil Shock, Anthropic Sues, and Market Wipeout Warning
20VC (20 Minute VC)
Mar 12
20VC: Anthropic vs The Pentagon: Who Wins | The Ultimate Stock Picks: What to Buy | The Data Centre Arms Race: Is the Capex War Stalling | The Era of Public Company Deceleration is Dead
Explore Related Topics
This podcast is featured in Best Cybersecurity Podcasts (2026) — ranked and reviewed with AI summaries.
Read this week's AI & Machine Learning Podcast Insights — cross-podcast analysis updated weekly.
You're clearly into The Changelog.
Every Monday, we deliver AI summaries of the latest episodes from The Changelog and 192+ other podcasts. Free for one show.
Start My Monday DigestNo credit card · Unsubscribe anytime