Valid certificates, stolen accounts: how attackers broke npm's last trust signal

On May 19, 633 malicious npm package versions passed Sigstore provenance verification. These packages were approved because the attacker used valid signing certificates generated from a compromised maintainer account.

Sigstore functioned as intended by confirming the package was built in a CI environment, issuing a valid certificate, and logging the details in the transparency log. However, it cannot verify if the credential holder authorized the publication, allowing malicious intentions to blend in with legitimate activities.

One day prior, StepSecurity reported an attack on the Nx Console VS Code extension, a popular developer tool with over 2.2 million lifetime installs. Version 18.95.0 was released using stolen credentials on May 18 and was live for less than 40 minutes. During this time, roughly 6,000 activations occurred, mostly through auto-update, compared to only 28 official downloads. The attack extracted Claude Code configuration files, AWS keys, GitHub tokens, npm tokens, 1Password vault contents, and Kubernetes service account tokens.

The Mini Shai-Hulud campaign, linked by various researchers to a financially driven threat actor known as TeamPCP, targeted the npm registry at 01:39 UTC on May 19. Endor Labs identified the initial wave when two dormant packages, jest-canvas-mock and size-sensor, released new versions with an obfuscated 498KB Bun script. These packages had not been updated for over three years, making the sudden update with raw GitHub commit hash dependencies a potential detection signal, but only if the tools are actively monitoring.

By 02:06 UTC, the worm spread across the @antv data visualization ecosystem and numerous unscoped packages, including echarts-for-react, which has around 1.1 million weekly downloads. Socket increased the total to 639 compromised versions across 323 unique packages in this wave. Over the entire campaign, Socket tracked 1,055 malicious versions across 502 packages in npm, PyPI, and Composer.

StepSecurity verified that the payload included full Sigstore integration. The attacker didn’t just steal credentials; they were able to sign and publish downstream npm packages with valid provenance attestations.

These incidents are not isolated. Research teams from Endor Labs, Socket, StepSecurity, Adversa AI, Johns Hopkins, Microsoft MSRC, and LayerX independently demonstrated that the developer tool verification model is flawed, with no vendor framework auditing all the failed attack surfaces.

Seven attack surfaces failed in the 48 hours between May 18 and May 19, including npm provenance forgery, VS Code extension credential theft, MCP server auto-execution, CI/CD agent prompt injection, agent framework code execution, IDE credential storage exposure, and shadow AI data exposure. The audit grid below outlines each.

The verification model is broken across all four major AI coding CLIs

Adversa AI unveiled TrustFall on May 7, revealing that Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI all auto-execute project-defined MCP servers once a developer accepts a folder trust prompt. All four default to “Yes” or “Trust,” allowing a single keypress to initiate an unsandboxed process with full developer privileges.

The MCP server operates with sufficient privileges to access stored secrets and source code from other projects. On CI runners utilizing Claude Code’s GitHub Action in headless mode, the trust dialog is never shown, enabling the attack to proceed without human interaction.

Researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong from Johns Hopkins published “Comment and Control,” demonstrating that a malicious instruction in a GitHub pull request title could cause Claude Code Security Review to disclose its own API key as a comment. This attack also worked on Google’s Gemini CLI Action and GitHub’s Copilot Agent, with Anthropic rating the vulnerability CVSS 9.4 Critical through its HackerOne program.

Microsoft MSRC reported two critical vulnerabilities in the Semantic Kernel on May 7. One vulnerability routes attacker-controlled vector store fields into a Python eval() call, while the other exposes a host-side file download method as a callable kernel function, allowing a poisoned document in a vector store to initiate a process on the host.

LayerX security researchers independently showed that Cursor stores API keys and session tokens in unprotected storage, making them accessible to any installed browser extension without elevated permissions.

The threat actors hunting these credentials doubled their operational tempo

The Verizon 2026 Data Breach Investigations Report, released on May 19, revealed that 67% of employees access AI services from non-corporate accounts on corporate devices. Shadow AI has become the third most common non-malicious insider action in DLP datasets. Source code is the most frequently submitted data type to unauthorized AI platforms, which the npm worm campaign also targeted.

The CrowdStrike 2026 Financial Services Threat Landscape Report, released on May 14, details the adversaries actively seeking the credential types harvested in these attacks.

STARDUST CHOLLIMA increased its attacks on financial entities threefold in Q4 2025. CrowdStrike documented the group using AI-generated recruiter personas on LinkedIn and Telegram, distributing malicious coding challenges resembling technical assessments, and hosting fake video calls in synthetic environments. Their targets include GitHub PATs, npm tokens, AWS keys, and CI/CD secrets. The shadow AI exposure in grid row 7 is the entry point they exploit.

Developer Tool Stolen-Identity Audit Grid

No vendor framework currently covers all seven surfaces. This grid maps each one to the research that exposed it, what your stack cannot detect, and the audit action to take before the next vendor renewal.

Security director action plan

Security directors should assess this grid against existing vendor contracts before Q2 renewals conclude—inquiring with each vendor about which of the seven surfaces their product addresses, and using non-answers to identify gaps.

Any credential accessible from a developer machine or CI runner that installed affected npm packages between 01:39 and 02:18 UTC on May 19 should be considered compromised. This includes GitHub PATs, npm tokens, AWS access keys, Kubernetes service account tokens, HashiCorp Vault tokens, SSH keys, and 1Password vault contents.

AI coding agent integrations running in CI/CD pipelines with pull_request_target workflows require careful examination. Each represents a prompt injection surface that interprets PR comments as agent instructions.

Procurement teams evaluating AI coding tools should consider adding a stolen-identity resistance evaluation to vendor assessments. The critical question is: can the vendor demonstrate how their tool differentiates between a legitimate maintainer publication and an attacker’s use of compromised credentials? If not, the tool does not serve as a verification layer.

The developer tool supply chain faces a challenge similar to what IAM encountered a decade ago: credentials confirm identity claims, not actual identity. IAM had a decade to implement compensating controls before nation-state groups industrialized credential theft. The AI coding tool ecosystem is now beginning that journey.