Git-based installs punch holes in npm’s post-Shai‑Hulud protections
Fresh research into the JavaScript toolchain shows that widely adopted mitigations after last year’s Shai‑Hulud worm do not fully hold under real‑world install flows. When projects pull a dependency straight from a Git repository, configuration files in that repo can silently change how the installer behaves-opening a path to run attacker code even when teams believe they have disabled lifecycle scripts and locked dependency trees. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-can-bypass-npms-shai-hulud-defenses-via-git-dependencies/))
One proof point stands out: “We have evidence that actors published a proof-of-concept abusing this technique to create a reverse shell in the past,” the researchers warned. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-can-bypass-npms-shai-hulud-defenses-via-git-dependencies/))
The risk is not limited to npm alone. pnpm, vlt, and Bun each had distinct gaps that undermined script blocking and, in some cases, lockfile integrity, though maintainers for those managers shipped fixes. npm’s behavior around Git dependencies remains unchanged at the time of writing. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/))
How the bypass works at install time
The core finding behind “PackageGate” is that install-time defenses behave differently depending on where code is fetched from. Controls that many enterprises now treat as baseline-disabling scripts with flags such as --ignore-scripts and relying on lockfiles for integrity-were designed for registry-hosted packages, not arbitrary Git repositories pulled into the dependency tree.
- Git dependencies are fetched from entire repositories rather than the canonical registry tarball, expanding the trusted computing base to every file in that repo, including configuration and helper scripts that would never ship in a registry package.
- A malicious “.npmrc” inside a Git dependency can override the git binary path; when nested Git dependencies are processed, the installer executes attacker‑controlled code despite “–ignore‑scripts=true”. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-can-bypass-npms-shai-hulud-defenses-via-git-dependencies/))
- In other managers, script allowlists and tarball handling rules missed edge cases that enabled execution or integrity bypasses during Git fetch or extraction phases. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/))
As one assessment put it: “An attacker who gets a package into your dependency tree (even several layers deep) can serve targeted payloads based on timing, IP address, or whatever other signals they want.” ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/))
What changed across package managers
The PackageGate research tested how different JavaScript package managers implement the same high-level promises-“no scripts are run” and “the lockfile is the source of truth”-and found that each tool enforced those guarantees differently when Git and tarball dependencies were involved.
| Package manager | Attack vector | Bypassed safeguard | Fix status | Notes / CVEs |
|---|---|---|---|---|
| npm | Git dependency ships malicious “.npmrc” that replaces git with attacker script | Script blocking via “–ignore-scripts” | Report closed as “works as intended” | Design places trust in entire Git repo contents; no CVE assigned. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/)) |
| pnpm | Scripts disabled during build did not cover Git dependency processing; tarball URL-only lock entries | Script blocking and lockfile integrity | Patched | CVE‑2025‑69263, CVE‑2025‑69264. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/)) |
| vlt | Path traversal on tar extraction; lockfile stored URL without integrity | Arbitrary file write and lockfile integrity | Patched | Fixes shipped within days of report. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/)) |
| Bun | Allowlist applied to package names, not sources | Script allowlist | Patched | Fixed in version 1.3.5. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-can-bypass-npms-shai-hulud-defenses-via-git-dependencies/)) |
Enterprise exposure: from developer laptops to CI and cloud
Shai‑Hulud demonstrated how install‑time code can steal credentials and propagate across repos and registries. The initial September 2025 wave compromised at least 187 packages; a second surge later in the year pushed the tally into the hundreds of packages and exposed roughly 400,000 raw secrets across tens of thousands of repositories. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/self-propagating-supply-chain-attack-hits-187-npm-packages/?utm_source=openai))
PackageGate reopens that threat surface in a subtler way. Many enterprises responded to Shai‑Hulud by tightening controls in continuous integration (CI) and shifting more trust to package manager flags and lockfiles. The new bypasses show that this trust can be misplaced when teams routinely pull dependencies straight from Git-whether to move faster than the registry, or to consume internal code that never gets published as a package.
- Credential theft targeted GitHub tokens and cloud keys, enabling automated republish of tainted packages and lateral movement through CI/CD. ([cisa.gov](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem?utm_source=openai))
- Guidance from national cyber authorities urged version pinning, dependency reviews, and immediate credential rotation across development estates. ([cisa.gov](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem?utm_source=openai))
For CISOs, that means the blast radius now spans developer laptops, shared build agents, and cloud-based runners wherever Git-based installs are allowed to reach sensitive credentials or production publishing keys.
Governance signal from the registry operator
In response to questions on the Git bypass, a statement emphasized that the installer’s current behavior is intentional and that work is underway to address the newly reported issue in parallel with ecosystem safeguards. “We are actively working to address the new issue reported as NPM actively scans for malware in the registry. The security of the NPM ecosystem is a collective effort, and we strongly encourage projects to adopt trusted publishing and granular access tokens with enforced two-factor authentication to fortify the software supply chain. GitHub continues to invest in strengthening NPM’s security, recently implementing changes to authentication and token management,” the company said. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/))
The stance underscores a persistent ambiguity in software supply-chain governance: where the line sits between platform guarantees and user due diligence. For large institutions-especially those operating under emerging national and sectoral cybersecurity rules-the answer increasingly matters not just for security posture but for regulatory accountability.
Risk triage for security leaders
For board‑level and public‑sector audiences, PackageGate lands in the middle of a broader shift: governments are moving from voluntary guidance toward formal expectations that software suppliers manage their dependency risk. In the United States, for example, the post-SolarWinds and Colonial Pipeline policy response has elevated software supply‑chain controls from “good practice” to an element of critical infrastructure and federal procurement oversight.
- Minimize or forbid direct Git dependencies in production paths. Where unavoidable, pin to immutable commit SHAs, require code review of the repository, and vendor artifacts into private registries.
- Standardize script execution policy in CI: run installers inside ephemeral, unprivileged sandboxes; disable postinstall where feasible; alert on unexpected child process launches during Git fetch/prepare phases. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/?msockid=3dd46bee099a65213e5a7d3408be641b&utm_source=openai))
- Adopt registry‑backed trusted publishing and granular, scoped tokens; enforce phishing‑resistant 2FA for all publisher accounts.
- Continuously rotate developer and CI/CD credentials; monitor for secrets exfiltration patterns and rogue public repos created by automation. ([cisa.gov](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem?utm_source=openai))
- Require provenance and integrity verification in builds (e.g., signed artifacts, reproducible builds) in addition to lockfiles; keep package managers updated to consume recent fixes. ([securityweek.com](https://www.securityweek.com/packagegate-flaws-open-javascript-ecosystem-to-supply-chain-attacks/))
For organizations that supply software to governments or operate critical services, these steps are not only technical hygiene; they are becoming table stakes for demonstrating “reasonable” supply‑chain risk management under frameworks such as the U.S. government’s Executive Order on Improving the Nation’s Cybersecurity.
Operational checklist and decision points
Security and engineering leaders now face a governance question as much as a tooling question: which teams are allowed to change dependency intake patterns, and how is that decision audited over time? The checklist below is designed to turn PackageGate‑style findings into concrete ownership and evidence.
| Control | Objective | Owner | Verification signal |
|---|---|---|---|
| Direct Git dependency policy | Reduce installer TCB and block .npmrc‑based overrides | Architecture review board | Deny‑list in dependency policy; exceptions pinned to commit SHA |
| Installer hardening in CI | Prevent lifecycle and prepare‑phase execution from reaching privileged contexts | DevOps platform team | Sandboxed runners; alerts on unexpected git/tool invocations |
| Publisher identity controls | Eliminate reusable secrets and raise bar for account takeover | Open‑source program office | Use of MFA and token hygiene enforced in org policy |
| Provenance and integrity validation | Detect tampering beyond lockfiles and registry hash checks | Release engineering | Builds fail without signed attestations or integrity mismatches |
Key dates from the Shai‑Hulud campaigns
Taken together, the Shai‑Hulud incidents and PackageGate disclosures trace a three‑stage arc for JavaScript supply‑chain security: initial shock, mitigation hardening, and now the realization that those mitigations can themselves be sidestepped.
- September 16, 2025: First wave publicly tracked; at least 187 packages compromised. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/self-propagating-supply-chain-attack-hits-187-npm-packages/?utm_source=openai))
- Late September 2025: Scale expands into hundreds of packages with automated propagation and secret theft. ([cisa.gov](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem?utm_source=openai))
- December 2, 2025: Second wave analysis highlights roughly 400,000 exposed secrets across more than 30,000 repositories. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/shai-hulud-20-npm-malware-attack-exposed-up-to-400-000-dev-secrets/?utm_source=openai))
- January 26-27, 2026: “PackageGate” research documents bypasses in npm, pnpm, vlt, and Bun; fixes land for pnpm, vlt, and Bun. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-can-bypass-npms-shai-hulud-defenses-via-git-dependencies/))
The open question for 2026 is whether platform maintainers and major software buyers treat PackageGate as an implementation bug to be patched away-or as a signal that governance and contractual expectations around software dependencies need to move in lockstep with the code.
