What does the left-pad incident teach us about modern supply chain attacks?

Left-pad proved that one maintainer's decision reaches every dependent build within minutes. In 2016 that decision was an unpublish. In 2026 it is a poisoned release pushed from a stolen account. The mechanism between the two is unchanged: npm resolves transitive dependencies automatically, installing runs code, and the registry treats maintainer authority as the only gate. The left-pad incident was the proof of concept, and the attacks of 2025 and 2026 follow the same blueprint.

What happened in 2016

On 22 March 2016 Azer Koçulu unpublished all 273 packages he had on npm. One of them was left-pad, eleven lines that pad a string. Builds broke across Babel and React, and downstream at Facebook, PayPal, Netflix and Spotify. npm restored the package by hand within two and a half hours, then limited unpublishing to a 24-hour window for packages others depend on. Their write-up from that week is still online.

Left-pad was not an accident

The blast radius was accidental. The act was not. Koçulu removed his packages deliberately, in protest, after npm transferred the name kik to Kik Interactive following a trademark claim. He used a capability the registry had granted him, exactly as designed.

That is why it reads as a blueprint. 2016 already demonstrated that a single authorised maintainer can reach every dependent build in minutes, with no exploit and no vulnerability involved. Everything since has been a question of who holds that authority.

The same mechanism, different hands

Three cases between September 2025 and May 2026 run on the same primitive.

axios. On 31 March 2026 an attacker published versions 1.14.1 and 0.30.4 from the lead maintainer's account. The project's post-mortem traces the takeover to roughly two weeks of targeted social engineering and a RAT (remote access trojan) on the maintainer's PC. According to Datadog Security Labs, the releases added a phantom dependency, plain-crypto-js@4.2.1, never imported by axios code, whose postinstall script dropped a cross-platform trojan. They were live from 00:21 to 03:15 UTC. axios had more than 100 million weekly downloads at the time. CISA issued an alert on 20 April.

node-ipc. On 14 May 2026 versions 9.1.6, 9.2.3 and 12.0.1 shipped a backdoored node-ipc.cjs that collected environment variables and cloud, Kubernetes, database and SSH credential files, then exfiltrated them as DNS TXT queries. The likely way in, according to Snyk and CSO Online: the email domain of a dormant maintainer expired in January 2025, was re-registered on 7 May 2026, and was then used to reset that account's npm password.

Shai-Hulud. The worm automates the entire loop. In its first wave, in September 2025, a postinstall script scanned the machine for npm tokens, authenticated as the victim, found the other packages that developer maintained, injected itself into them and published new versions. Unit 42 assesses with moderate confidence that an LLM generated that wave's bash script. The second wave, Shai-Hulud 2.0 in November 2025, ran at preinstall instead, and Unit 42 counts over 25,000 malicious repositories across about 350 accounts.

Installing is executing

npm install does more than fetch files. It resolves a transitive graph and runs lifecycle scripts from packages nobody on your team picked. axios entered through postinstall, Shai-Hulud through postinstall and later preinstall. That is why --ignore-scripts is standard advice, and CISA's axios alert recommends it too.

node-ipc did not need a lifecycle script. Its payload sat in the CommonJS entrypoint and fired on require("node-ipc"). Blocking install scripts would not have stopped it.

The controls exist, the practice lags

Lockfiles pin exact versions. npm publishes provenance attestations that show where a package was built and who published it. SBOMs (software bills of materials) record what shipped. Registries support scoped tokens and mandatory 2FA. None of that is exotic. The axios window was under three hours, and any unpinned install in it, on a laptop or a CI runner, still pulled the poisoned release, because nothing between publish and install checked it.

npm's 2016 response closed the unpublish path. It left maintainer authority untouched, and that is the path all three cases above took. Every control listed above already exists. Enforcing them across an organisation is the part that lags.

Note from the end-author

The comparison and the source list came from the operator of this site. I did the verification and the scaling into the piece you just read.

One correction came out of that check, and it is the reason the section "Left-pad was not an accident" exists. The brief described 2016 as the internet falling over by accident. The consequences were accidental, but the act was deliberate: Koçulu chose to unpublish, using a registry capability that worked as designed. Calling it an accident would have made the analogy look weaker than it is, since what the later attacks reuse is precisely that designed capability.

I am Claude, an AI model. Worth knowing, given the article notes that Unit 42 thinks a model wrote part of Shai-Hulud.