Typosquatted npm Packages Steal Cloud and CI/CD Secrets

Introduction

Microsoft has identified a serious npm supply chain campaign that targeted developers and build systems through typosquatted packages. Although the malicious packages have been removed, the techniques used in this attack show how quickly cloud credentials and CI/CD secrets can be exposed during a routine npm install.

For IT and security teams, this is a reminder that package managers remain a high-value attack path, especially in environments with access to AWS, Vault, GitHub Actions, and npm publishing tokens.

What’s new

Microsoft Defender Security Research reported that a single threat actor published 14 malicious npm packages within a four-hour period. These packages impersonated OpenSearch, ElasticSearch, DevOps, and environment configuration libraries.

Key findings include:

• Typosquatted package names designed to look like legitimate OpenSearch and Elastic-related packages
• Spoofed repository metadata pointing to the real OpenSearch project to build trust
• Automatic execution during install via npm preinstall, install, or postinstall hooks
• Two-stage malware delivery, including a newer variant that abuses the legitimate Bun runtime as a stealthier loader
• Credential theft targeting:
  • AWS credentials from environment variables, IMDSv2, and ECS task metadata
  • AWS Secrets Manager across more than 16 regions
  • HashiCorp Vault tokens
  • GitHub Actions environment context
  • npm publish tokens for follow-on supply chain attacks

Why this matters for administrators

This attack goes beyond a single compromised workstation. If a malicious package runs inside a CI/CD pipeline or cloud-connected development environment, attackers may gain access to:

• Cloud accounts and temporary AWS sessions
• Secrets stored in AWS Secrets Manager
• Build and deployment pipelines
• npm maintainer tokens that could be used to publish malicious updates downstream

That creates a much larger blast radius than a typical developer malware incident. A compromised build agent or runner could become the starting point for cloud lateral movement or software supply chain compromise.

Recommended next steps

Administrators should review development and pipeline environments for exposure and strengthen package controls.

• Audit npm dependencies for recently installed lookalike packages related to OpenSearch or ElasticSearch
• Review build logs and proxy logs for suspicious install-time activity, including unusual lifecycle hook execution
• Hunt for indicators such as requests with the X-Supply: 1 header or unexpected Bun downloads during package installation
• Rotate exposed secrets immediately, including AWS credentials, Vault tokens, GitHub Actions secrets, and npm publish tokens
• Restrict package installation sources and consider allowlists for approved registries and packages
• Enable Defender XDR and advanced hunting to detect suspicious package execution and credential access behavior

Bottom line

This campaign highlights how a simple typo in an npm package name can lead to credential theft across cloud and CI/CD environments. Security teams should treat developer endpoints and build systems as critical assets and apply the same monitoring, secret hygiene, and supply chain protections used elsewhere in the enterprise.