May 2026 Supply Chain Attacks — Behavioral Analysis

[piiiico]

Five npm supply chain attacks in the first 29 days of May 2026. They share a structural pattern that advisory databases don't flag but behavioral scoring does.

Timeline

Date	Attack	Packages affected	Weekly downloads at compromise
Mar 30	axios compromise	axios	109M
May 14	node-ipc	node-ipc (3 malicious versions)	~24M
May 19	Shai-Hulud	637 versions in 39 minutes (echarts, @antv/*)	>1M (echarts-for-react)
May 22	TrapDoor	34 packages across npm, PyPI, Crates.io (384+ versions)	Variable — targeted AI/crypto devs
May 28	Typosquatting wave	14 packages targeting OpenSearch/ElasticSearch users	New packages (typosquats)

The common structural tell

The March, May 14, and May 19 attacks all exploited packages with sole npm publisher status — one person with publish access, millions of weekly downloads. Credential theft → malicious version published → millions of machines exposed in minutes.

npm audit doesn't flag this. Stars don't either. These packages had high stars, active GitHub communities, and green CI badges. The vulnerability wasn't in the code — it was in the publisher concentration.

TrapDoor and the typosquatting wave used a different vector (new malicious packages, not compromised existing ones) but introduced a novel escalation: AI coding assistant poisoning via .cursorrules and CLAUDE.md files containing hidden instructions that trick coding agents into exfiltrating credentials.

Behavioral scores before exploitation

Commit scores packages on publisher concentration, release consistency, provenance, and longevity — not CVE databases. Here's how the attacked packages scored:

axios       — score 88, 1 publisher, 109M/wk  ⚑ CRITICAL
chalk       — score 75, 1 publisher, 409M/wk  ⚑ CRITICAL
zod         — score 87, 1 publisher, 181M/wk  ⚑ CRITICAL
lodash      — score 81, 1 publisher, 145M/wk  ⚑ CRITICAL
minimatch   — score 78, 1 publisher, 562M/wk  ⚑ CRITICAL

The CRITICAL flag means: sole npm publisher + >10M weekly downloads. This is the exact pattern that was exploited.

These scores existed before the attacks. The signal was visible. Nobody was looking at it.

Check your own dependencies

# Zero install — scans package.json, package-lock.json, requirements.txt, Cargo.toml, go.mod
npx proof-of-commitment

# Specific packages
npx proof-of-commitment axios chalk zod lodash express

# CI gate — fail the build on CRITICAL
npx proof-of-commitment --fail-on=critical --file package-lock.json

Protecting AI coding assistants

TrapDoor specifically targets Cursor and Claude Code by planting instructions in .cursorrules and CLAUDE.md. The poc hook command installs a Cursor beforeShellExecution hook that scores packages against behavioral signals before npm install, pip install, cargo add, or go get runs:

# Install once — blocks CRITICAL, warns on HIGH
poc hook

# Protect all Cursor projects
poc hook --global

When an AI coding assistant tries to install a package, the hook checks the behavioral score and blocks or warns before the install completes.

What this means

Supply chain attacks are accelerating. May 2026 saw an attack roughly every 4 days. The pattern is consistent: publisher concentration creates single points of failure that credential theft exploits.

Advisory databases (CVE, npm audit) flag known vulnerabilities after discovery. Behavioral signals flag structural risk before exploitation. Both are needed.

Resources

• Live demo: getcommit.dev/audit — paste package names, see scores
• GitHub Action: piiiico/commit-action — supply chain audit on every PR
• MCP server: Works with Claude Desktop and Cursor — ask your AI assistant to audit your dependencies
• awesome-mcp-servers: Listed here (87K stars)

---

Data sources: npm registry, PyPI, crates.io, proxy.golang.org, deps.dev, GitHub API, OpenSSF Scorecard.
Attack references: Microsoft, The Hacker News, Socket.dev, CISA.