Severity
Exposure
Date of incident
NPM Supply Chain Compromise
confirmed
Tier -
B
Compromised npm package ran on agent developer workstation — no install-time execution boundary.
What Happened
Malicious npm package versions executed on developer workstations during routine installs; IDE agents with shell and skill import amplified credential exposure on machines also running MCP servers.
Sumarry
CISA alerted on widespread npm supply-chain compromise (Shai-Hulud); developer machines running IDE agents and MCP skill loaders are high-risk install surfaces.
Detect
Dependency pin + NHIM-014 secret scan on agent workspace
What Happened
Mask API keys at agent ingress; lockfile CI gate
Blekline //
Trust Vault mask on keys in agent context
Without agent boundary //
Lockfile review in CI — local npm install already ran malware
