September 2025 NPM Attack Hit 2.6B Weekly Downloads. Most Found Out on Twitter
A September 2025 supply-chain attack on the NPM ecosystem affected packages with a combined 2.6 billion weekly downloads, with many developers first learning about the breach through Twitter rather than official channels. The incident highlighted ongoing vulnerabilities in open-source dependency management and communication gaps during security incidents.
Background
- NPM (Node Package Manager) is the default package registry for JavaScript/Node.js, used by millions of developers to download open-source code libraries. A "supply chain attack" on NPM means malicious code is hidden inside a seemingly legitimate package; when developers install it, the malware runs on their machines or in their production environments.
- The article describes a massive attack in September 2025 where malicious packages on NPM were downloaded an estimated 2.6 billion times per week. The scale dwarfs past incidents (e.g., the 2021 "colors" and "faker" sabotage or the 2022 "node-ipc" protestware).
- Key detail: most of the developer community learned about the attack not from NPM's own security team or official channels, but from social media (Twitter/X), raising questions about disclosure and response speed.
- This matters because a single compromised NPM package can cascade into thousands of downstream applications, including enterprise software, e-commerce, and backend services — a supply-chain breach at this scale represents one of the largest software security incidents in history.