The September 2025 npm Attack Hit 2.6 Billion Weekly Downloads. Most Teams Found Out from Twitter.
Security Analysis
The September 2025 npm Attack Hit 2.6 Billion Weekly Downloads. Most Teams Found Out from Twitter.
chalk. debug. ansi-styles. strip-ansi. Packages in virtually every JavaScript project. Gone malicious for hours before most CI pipelines knew.
On September 8, 2025, a threat actor sent a phishing email to a package maintainer impersonating npm support. Within hours, 18 widely used npm packages — including chalk, debug, ansi-styles, and strip-ansi — had malicious versions published carrying obfuscated JavaScript. The payload silently rewrote cryptocurrency wallet transactions. The combined download count of the affected packages: over 2.6 billion per week .
Most organizations found out the same way everyone finds out about npm incidents: a tweet, a Slack message from a panicked developer, or a security newsletter the next morning. Then began the scramble: which of our services pull these packages? Which version did our last build lock to? Did anything ship to production in the window?
The Axios npm package — 100 million weekly downloads — was compromised by a North Korean threat actor on March 31, 2026, with a hidden dependency installing a remote access trojan across developer machines and CI/CD pipelines before detection. On June 1, 2026, attackers compromised Red Hat employee GitHub credentials to inject malware into 32 packages under the @redhat-cloud-services namespace — with valid SLSA provenance, because the malicious packages were genuinely built by the legitimate pipeline. The certificate was accurate. The code was not.
This is the real shape of supply chain risk in 2026: not a CVE you can patch, but a package you trusted yesterday that you cannot trust today. And the question is always the same: do you know what you're running, right now?
Why Snyk and Dependabot Don't Fully Solve This
Before going further, the obvious objection: don't tools like Snyk and Dependabot already handle this?
Partly. Dependabot watches manifest files, opens PRs for version updates, and flags known vulnerabilities from the GitHub Advisory Database. It performs no reachability analysis — it treats every CVE match as equal priority, which produces significant noise on large projects. It does not scan containers, IaC, or licence compliance.
Snyk is more comprehensive — it resolves the full transitive dependency tree and offers reachability analysis for Java, JavaScript, and Python. But Snyk's known pain points, documented consistently by users in 2025–2026, include high false positive rates in SAST, fragmented product experience across modules, and costly add-ons for CI/CD integration and container scanning.
More fundamentally: both tools produce lists . They tell you what is vulnerable. They do not tell you what to do about it in the context of your specific stack, your current sprint priorities, your licence constraints, and your risk appetite. That interpretation gap is where the 252 days go.
Veracode's 2025 State of Software Security report, based on 1.3 million applications and 126.4 million findings, found the average time to fix a security flaw has risen 47% over five years — from 171 days to 252 days . Half of all organizations carry critical security debt: unresolved, high-exploitability vulnerabilities open for over a year. Over 70% of that debt originates from third-party code.
The problem is not finding vulnerabilities. Every serious team has a scanner. The problem is the human triage loop that sits between "scanner found something" and "engineer fixed something."
What the September 2025 Attack Exposed About Detection Latency
The chalk/debug/ansi-styles attack is the clearest illustration of why list-based tools are insufficient for the current threat model.
The attack vector was not a known CVE. There was no CVSS score. There was no NVD entry. The packages were legitimate — they just had malicious versions published. Mondoo's 2026 State of Vulnerabilities analysis makes this point explicitly: in 2025, there were 4x more malicious npm packages (192,742) than CVEs published (48,175) . These malicious packages carry no CVE identifiers and are invisible to traditional scanners.
The organizations that responded quickly in September 2025 shared one characteristic: they had a current, accurate dependency manifest and a process to cross-reference it against package integrity data within minutes of an incident. As one post-incident analysis put it: "the organizations who had unified visibility into their supply chain were the ones who responded effectively. The rest were scrambling."
The question an agentic workflow answers that a static scanner cannot: "Is what we're running right now what we think we're running?"
The Agentic Layer: What It Actually Adds
An agentic security workflow is not a replacement for Snyk or Dependabot. It is the reasoning and routing layer that sits above them —...