What AWS Security learned from responding to recent npm supply chain threat campaigns

This article details AWS Security's response to recent npm supply chain attacks and lessons learned from three major incidents in 2025.

• Nx package compromise in August used malicious JavaScript to exploit GenAI tools via npm
• Shai-Hulud worm in September targeted 180+ packages, harvesting npm and GitHub tokens
• Tea token farming campaign in October-November compromised over 150,000 malicious packages
• AWS established incident command within 30 minutes of detecting Nx compromise
• Implemented repository-level blocklisting and enhanced GenAI security guardrails
• Coordinated with Open Source Security Foundation for community-wide response
• Detected Shai-Hulud packages within 7 minutes of publication
• Used AI to analyze obfuscated code and identify malware capabilities
• Registered malicious packages with OpenSSF within 30 minutes of detection
• Recommend layered protection: continuous monitoring, vulnerability scanning, credential management, network controls
• Maintain comprehensive open-source dependency inventory for rapid response
• Share threat intelligence and participate in collaborative defense initiatives

AWS emphasizes that supply chain attacks exploit trust relationships at massive scale using credential harvesting and evasion techniques, requiring layered security controls and continuous monitoring.