What is an npm supply chain attack?

An npm supply chain attack occurs when malicious code is injected into a package you depend on — via a typosquatted package name, a compromised maintainer account, or malicious install lifecycle scripts (postinstall) that steal environment variables or credentials when you run npm install.

How do AI coding tools create npm supply chain risks?

AI coding tools sometimes hallucinate npm package names — they suggest packages that do not actually exist on npm. Attackers monitor these hallucinated names and register them as malicious packages. A developer who installs the AI-suggested package without verifying it then installs malware.

How do I check if my npm packages are safe?

Run npm audit to check for known CVEs. For unfamiliar packages, verify them on npmjs.com — check the author, download count, creation date, and linked repository. Be suspicious of packages created recently or with very few downloads. Use npm ls to view your full dependency tree.

What is npm typosquatting?

Typosquatting is when a malicious package is registered with a name very similar to a popular package (e.g., 'coloers' instead of 'colors'). Developers who mistype a package name or follow an AI suggestion may accidentally install the malicious version, which runs code at install time.

May 28, 2025

npm Supply Chain Attacks: How AI Coding Tools Create Vulnerabilities

When Cursor or Claude suggests a package that doesn't exist, attackers register it as malware. Here's how to find and fix supply chain vulnerabilities in your app.

The AI hallucination attack vector

AI coding assistants are trained on code from across the internet. Sometimes they suggest packages that don't exist — they've seen similar package names in training data and extrapolate. This is called an AI hallucination.

Attackers monitor for these hallucinated package names and register them on npm with malicious code. When a developer installs the suggested package, they install malware.

Known examples of packages AI assistants have hallucinated that attackers registered:

@anthropic/sdk (real: @anthropic-ai/sdk)
react-server-dom-webpack variants
next-auth-providers (real: next-auth)

Typosquatting: one letter off from real packages

Typosquatting is a separate but related attack. Attackers register packages with names one or two characters different from popular packages, hoping developers make typos when installing.

With AI coding tools, this risk is amplified — the AI might suggest the typosquatted name directly.

Known typosquats to watch for

axois → axios

lodahs → lodash

expres → express

recat → react

momnet → moment

crossenv → cross-env

babelcli → babel-cli

node-uuid → uuid

How to audit your dependencies

1. Run npm audit

npm audit
# or
npm audit --audit-level=high

This checks your installed packages against the npm advisory database for known CVEs. Fix critical and high severity issues before deploying.

2. Check package download counts

Legitimate packages have download histories. A package with 0 downloads or that was created last week is suspicious.

# Check package info
npm info package-name

# Check weekly downloads
curl https://api.npmjs.org/downloads/point/last-week/package-name

3. Verify package maintainers

Check that the package is maintained by the organization you expect. @anthropic-ai/sdk should be maintained by Anthropic. If the maintainer is an unknown individual, be suspicious.

4. Check for install scripts

# View package.json of an installed package
cat node_modules/package-name/package.json | grep -A5 '"scripts"'

Malicious packages often use postinstall scripts to execute code when installed. Legitimate packages rarely need install scripts.

Preventing supply chain attacks going forward

Always verify package names before installing — check npmjs.com directly
Use npm ci instead of npm install in CI/CD to use the lockfile exactly
Enable Dependabot or Renovate for automated dependency updates
When an AI suggests a package you don't recognize, search for it on npm before installing
Consider using Socket.dev or Vezraa to scan your dependencies automatically

Scan your dependencies for typosquats and CVEs.

Start Scanning →