JavaScript Supply-Chain Risk: Malicious npm Package and Package Manager Guardrail Bypasses

Security researchers reported an npm supply-chain compromise involving a malicious package, polymarket-clob, that targeted cryptocurrency users by exfiltrating sensitive local files (including .env, wallets.json, and keys/*.json) to attacker-controlled infrastructure. The package was published in the npm registry, downloaded at least 189 times (lower bound), and later removed and replaced with a security placeholder; analysis of the code and infrastructure pivoting linked the campaign to broader activity consistent with wallet-drainer operations and Vidar stealer-related infrastructure, including reuse of SSH fingerprints and consistent hosting patterns.

Separately, researchers disclosed six JavaScript “zero-day” bypass issues across multiple package managers—npm, pnpm, vlt, and Bun—that undermine common defensive controls used to reduce supply-chain risk, including disabling lifecycle scripts and relying on lockfile integrity. The issues (dubbed “PackageGate”) reportedly enable paths to regain install-time code execution or weaken integrity guarantees via mechanisms such as Git dependency handling, tar extraction behaviors, and incomplete integrity coverage for URL-based tarballs; pnpm, vlt, and Bun were reported as patched, while npm characterized the behavior as “works as expected,” raising concern that package-manager-level weaknesses could enable large-scale compromise even in hardened environments.