Attackers bypass npm’s Sigstore provenance, compromise 639 package versions in 48-hour supply chain breach

Quick Facts

• 639 malicious npm package versions passed Sigstore provenance verification between May 18-19, affecting packages with 16 million weekly downloads
• GitHub invalidated 61,274 npm granular access tokens and confirmed 3,800 private repositories were exfiltrated through compromised VS Code extensions
• Attack represents first documented case of malware generating valid SLSA provenance certificates by hijacking legitimate CI pipelines

A sophisticated supply chain attack compromised 639 npm package versions across 323 unique packages in May 2026, marking the first time malicious code successfully generated valid Sigstore provenance certificates. The attack unfolded over 48 hours from May 18-19, exploiting seven different attack surfaces simultaneously.

The campaign began with a compromised VS Code extension, Nx Console version 18.95.0, published using stolen credentials. Though live for under 40 minutes, the malicious extension achieved approximately 6,000 activations through auto-updates.

Endor Labs detected the main npm attack at 01:39 UTC on May 19 when jest-canvas-mock@2.5.3 was published. By 02:06 UTC, the worm had published 42 confirmed malicious packages. The atool account, which maintained 547 npm packages, saw 314 packages hit with 637 malicious versions in two automated waves.

“TanStack had the right setup on paper: OIDC trusted publishing, signed provenance, 2FA on every maintainer account. The attack worked anyway,” said Peyton Kennedy, Senior Security Researcher at Endor Labs. “What the orphaned commit technique shows is that OIDC scope is the actual control that matters here, not provenance, not 2FA.”

The attack exploited a fundamental weakness in supply chain security verification. Malicious packages carried valid provenance badges while still stealing credentials. The certificate subjects showed legitimate CI identities, Rekor log entries were authentic, and verification checks passed.

Major organizations affected included Mistral AI, UiPath, and dozens of other maintainers. The @tanstack/react-router package alone receives over 12.7 million weekly downloads. GitHub confirmed that approximately 3,800 private repositories were exfiltrated through compromised developer workstations.

The payload demonstrated sophisticated persistence techniques, writing hooks into Claude Code’s SessionStart config and VS Code’s folder-open task runner. “The attacker treated the AI coding agent as part of the trusted execution environment, which it is,” Kennedy explained. “These tools read your repo, run shell commands, and have access to the same secrets a developer does.”

This attack represents the culmination of a campaign tracked since September 2025. Each wave targeted higher-download packages and introduced more sophisticated access vectors. The orphaned commit technique proved particularly novel, as branch protection rules don’t apply to commits not on any branch.

GitHub responded by removing 640 malicious packages and invalidating 61,274 npm granular access tokens with write permissions and 2FA bypass. The incident highlights a critical gap in automated trust signals, where valid provenance certificates can now camouflage malicious code.

Read more: Valid certificates, stolen accounts: how attackers broke npm’s last trust signal