The Mac You Trust Runs the Code You Never See

by

The blind spot

Ask the average Mac owner how malware gets onto their machine and you will hear a familiar mental model: you download a shady app, you ignore a Gatekeeper warning, you click something you should not have. Apple has spent more than a decade training users to think exactly this way, and its defenses (Gatekeeper, notarization, XProtect) are built around the same assumption: that danger arrives as a file you consciously choose to open.

Malicious npm packages break that assumption completely. They do not arrive as an app. They do not trip a Gatekeeper prompt. They are neither notarized nor un-notarized, because Apple’s trust system never looks at them. They arrive as a line in a dependency tree, often a line no human ever typed — and they run with your permissions the moment you type npm install. For a growing share of macOS users, this is now the single most likely way for attacker code to execute on their machine, and most of them do not know the attack surface exists.

In Moonlock’s 2026 macOS malware trends report, we flagged supply chain compromise as the default access strategy for the year ahead. This article is most useful to developers, web3/crypto builders, and DevOps engineers on Macs whose machines hold the SSH keys, cloud credentials, and wallets these campaigns target, as well as the security teams who must explain why one engineer’s install command is now a plausible breach path.

The scale problem

Open-source malware stopped being a curiosity years ago. Across the major registries, Sonatype identified more than 454,600 new malicious packages during 2025 alone, pushing its cumulative catalogue past 1.2 million; year over year, the volume of detected malware rose 188%. The trend line is not gradual — Q3 2025 by itself saw 34,319 new malicious packages, a 140% jump over the prior quarter.

Two details from that data matter for Mac users specifically.

First, npm is where the action is. By Q4 2025, Sonatype reported that 99.8% of newly observed malware originated from npm — the JavaScript registry that sits underneath nearly every modern web and desktop application. npm requires no namespace validation, and tooling defaults to the latest version, giving attackers the fastest possible path from “publish a package” to “code running on a developer’s laptop.”

Second, the goal shifted from vandalism to theft. Data exfiltration (harvesting tokens, keys, credentials, and wallet material) became the dominant category through 2025, rising to 56% of malware in Q1 from 26% the previous quarter. This is not crypto-miners stealing CPU cycles. It is malware purpose-built to take things of value: SSH keys, cloud credentials, browser sessions, and crypto wallets — all of which sit, unencrypted or trivially decryptable, in predictable locations inside a macOS home directory.

Why npm is a near-perfect macOS attack surface

Three structural facts make the JavaScript supply chain unusually dangerous on macOS specifically.

  • Macs are developer machines. The population most exposed to npm such as software engineers, web3 builders, DevOps staff — skews heavily toward macOS as a primary workstation. When a poisoned package executes, it lands on a laptop that very likely also holds iMessage history, Apple Notes, Safari cookies, and personal crypto wallets, right beside production credentials.
  • npm install runs arbitrary code, and Apple’s defenses never see it. A package can declare a postinstall script that runs automatically during installation. No Gatekeeper dialog, no “open anyway?” prompt — because none of Apple’s app-trust machinery is in the path. We argued in the 2026 trends piece that “signed and notarized” no longer means safe. The npm case is sharper: the malware never even applies for a signature. It simply runs as the user.
  • Transitive dependencies hide the blast radius. You do not have to install a malicious package on purpose. A modern app pulls in dozens of direct dependencies, which pull in hundreds of indirect ones. When foundational utilities are poisoned, every project that depends on them directly (or five layers deep) inherits the compromise.

Put those together and you get a threat that targets Macs without ever looking like Mac malware. It looks like a routine build step.

The incidents that defined the threat

Below are the campaigns that, between late 2024 and mid-2026, turned npm supply chain attacks from a theoretical worry into a recurring emergency. Each has a backstory worth understanding, because the how of each compromise reveals where the ecosystem is weakest.

@solana/web3.js: the end-user wake-up call — December 2024

Most supply chain stories are about developers. This one is about everyone downstream of them. @solana/web3.js is the standard JavaScript library for building on the Solana blockchain, with several hundred thousand weekly downloads at the time. On December 2, 2024, an attacker spear-phished a member of the @solana npm organization who held publish access — reportedly with a lure inviting collaboration on a private package — and harvested their credentials and 2FA code. With that access, the attacker pushed two malicious versions (1.95.6 and 1.95.7) carrying a backdoor that captured private keys and sent them to a hardcoded wallet address.

The malicious versions were live for roughly five hours. On-chain analysis tied the attacker’s address to around $160,000 in stolen SOL plus tens of thousands more in other tokens. The incident received CVE-2024-54134.

Why it matters for Mac users who do not write code: the people at risk were not only the developers who ran npm install. They were the end users of any app or trading bot that handled private keys and happened to update during that five-hour window. A Mac owner who never opens Terminal can still lose holdings because a Solana app they trusted shipped a poisoned dependency. You inherit the supply chain of every app you run.

Backstory.  The compromise was pure social engineering against a single human with publish rights — no exploit of Solana itself. The weak point was a person’s inbox, not the protocol that crypto users usually worry about.

“s1ngularity” (Nx): AI-weaponized attack, and it ran on Macs — August 2025

On August 26, 2025, attackers published malicious versions of Nx — a widely used JavaScript build system — and several plugins. The entry point was a vulnerable GitHub Actions workflow that leaked a token with publish rights; the releases were live for around five hours.

Two things make s1ngularity essential here. First, the payload ran only on macOS and Linux. The malicious telemetry.js script swept the machine for SSH keys, .gitconfig, .env files, npm and GitHub tokens, cloud credentials, and crypto wallets. This was not a Windows campaign with incidental Mac fallout — the target environment was the Unix developer workstation, which on this population overwhelmingly means a Mac.

Second, it weaponized local AI assistants. The malware searched for installed AI command-line tools such as Claude, Gemini, and Amazon’s Q — and invoked them with permission-bypassing flags to help inventory and locate sensitive files. Wiz described this as one of the first documented cases of malware turning a developer’s own AI tooling against them; it worked in hundreds of cases, though provider guardrails sometimes intervened.

The fallout was self-amplifying. Stolen data was uploaded to public GitHub repositories the malware created under victims’ own accounts (named s1ngularity-repository-*), removing the need for attacker-controlled C2. Wiz counted 2,349 distinct leaked secrets, and roughly 90% of more than 1,000 leaked GitHub tokens were still valid. A second wave used those tokens to flip private repositories public — eventually affecting over 400 organizations and 5,500+ repositories.

Backstory.  s1ngularity is the cleanest illustration of how a CI/CD misconfiguration becomes a mass credential breach, and the first real-world proof that “I have AI CLIs installed” is now part of the attack surface. The macOS-only payload is the detail to lead with for this audience.

chalk, debug, and the 2.6-billion-download phish — September 8, 2025

If s1ngularity showed sophistication, the chalk/debug compromise showed reach. chalk (terminal styling) and debug (logging), with 16 other utilities like ansi-styles and strip-ansi, are invisible plumbing imported transitively by an enormous fraction of the JavaScript ecosystem; collectively the affected packages see over 2.6 billion downloads per week.

The compromise itself was almost mundane. A prolific maintainer (handle: qix) received a convincing phishing email from the fake domain npmjs[.]help, dressed as a 2FA reset notice. The attacker captured username, password, and a live one-time code, took over the account, and published malicious versions across all 18 packages. The payload was a browser-side crypto clipper: it hooked network and wallet APIs and silently rewrote transaction destinations to attacker addresses before signing.

The community caught it fast — malicious versions were live for roughly two hours. The financial haul was reportedly modest, partly because of that speed and because the clipper only paid off when a victim happened to be signing a crypto transaction. The lesson is the scale, not the payout: one phishing email put crypto-stealing code into the dependency tree of thousands of downstream applications in under two hours. The payload targeted crypto; the vulnerability it demonstrated is agnostic to what the payload does. Next time it could be a macOS credential sweeper.

Backstory.  The look-alike domain npmjs[.]help is the detail to dwell on — the entire 2.6-billion-download incident traces to one fake domain and one tired maintainer. The same actor reportedly pressured a second maintainer into compromising the duckdb packages shortly after.

Shai-Hulud: npm’s first self-replicating worm — September & November 2025

This is the incident that changed the category. Discovered in mid-September 2025, Shai-Hulud (named after the sandworms of Frank Herbert’s Dune) was the first true self-replicating worm observed in npm. The mechanism is a closed loop:

  1. A compromised package’s postinstall script runs on a victim’s machine.
  2. It downloads and runs TruffleHog — a legitimate open-source secret scanner — to hunt the filesystem and environment for npm tokens, GitHub PATs, and AWS/GCP keys.
  3. Exfiltration goes to attacker-controlled webhooks and to public GitHub repositories named Shai-Hulud; it also flips private repos public to expose hardcoded secrets.
  4. Using any valid npm token it finds, it automatically republishes trojanized versions of every other package the victim maintains — seeding the next round with no human and no central C2.

Between September 14 and 18, the worm compromised over 200 packages and 500+ versions. Black Duck observed the campaign primarily affected Linux and macOS environments — again, the Unix developer workstation. It came back worse: on November 24, 2025, the community identified Shai-Hulud 2.0, which backdoored 796 unique npm packages totaling over 20 million weekly downloads and could self-replicate entirely offline by reading its own code. Sonatype attributed a 53,000% surge in “repository abuse” in Q4 2025 largely to a single self-replicating campaign of this type.

Backstory.  The grim elegance: the worm uses defenders’ own tooling (TruffleHog) as its credential scanner, and the victim’s own npm and GitHub accounts as both exfiltration channel and propagation engine. There is no attacker server to take down — the single point of failure has been removed by design.

“Contagious Interview”: industrialized, and built for the macOS Keychain — Ongoing

Where the previous incidents were opportunistic account takeovers, this one is a sustained, state-aligned operation — and the most directly macOS-aware of all. Contagious Interview is a North Korea-aligned campaign (tracked by MITRE as G1052, overlapping with Lazarus-associated activity) active since late 2023. Operators pose as recruiters on LinkedIn, approach developers — especially in crypto and web3 — with fake job offers, then deliver “coding assignments” or “demo projects” via GitHub, Bitbucket, or Google Docs that pull in malicious npm packages the target runs locally.

The throughput is industrial. Across 2025, researchers catalogued hundreds of malicious npm packages tied to the campaign; one October 2025 wave from Socket counted 338 packages, and a later wave added nearly 200 more with 31,000+ downloads, delivering the BeaverTail and OtterCookie infostealers and the InvisibleFerret backdoor. Taken-down packages reappear under fresh accounts within days. Sonatype attributed more than 800 packages to Lazarus-associated activity in 2025, 97% of it in npm.

The macOS specificity is the part to emphasize. Socket’s analysis confirms these payloads explicitly target macOS Keychain items, alongside browser credentials and crypto-wallet data, with InvisibleFerret maintaining cross-platform persistence on Windows, macOS, and Linux. This is malware written with the Mac data model in mind. North Korea-linked groups are estimated to have stolen over $2 billion in crypto in 2025.

Backstory.  The lure inverts the usual threat model. The victim is not tricked into installing something sketchy — they are a job-seeker eagerly running a “technical assessment” they believe will get them hired. The npm package is the weapon; the fake interview is the delivery system.

axios: a RAT inside the web’s most popular HTTP client — March 2026

axios is the JavaScript ecosystem’s most-used HTTP client — more than 100 million weekly downloads and over 174,000 dependent packages. On March 30-31, 2026, an attacker compromised the lead maintainer’s npm account (jasonsaayman) and published two backdoored releases, 1.14.1 (tagged latest) and 0.30.4 (tagged legacy), 39 minutes apart. The releases were live for about three hours.

The technique was surgical. The attacker did not touch axios source code. Each release made a manifest-only change, adding a single phantom dependency plain-crypto-js@4.2.1, whose postinstall hook fetched the real payload. That dependency had been pre-staged roughly 18 hours earlier, with a clean decoy version published first so it would not trip “brand-new package” alarms. The payload was a cross-platform Remote Access Trojan that fetched an operating-system-specific second stage — a distinct build for macOS, Windows, and Linux — then overwrote its own files with a clean decoy so that node_modules looked normal to anyone investigating afterward.

Microsoft Threat Intelligence attributed the operation to Sapphire Sleet, a North Korean state actor focused on cryptocurrency, venture capital, and blockchain targets. CISA issued an alert; because this was not a flaw in axios’s own code, no CVE was assigned, and tracking ran through GitHub Security Advisories. For Mac users the takeaway is blunt: the most popular HTTP client on the internet shipped, for three hours, a build that delivered a purpose-built macOS RAT to anyone who ran a fresh install.

Backstory.  The supply chain attack had its own supply chain. Before axios was touched, the maintainer’s personal machine was compromised through a targeted social-engineering campaign and a RAT — the same DPRK playbook as Contagious Interview. Researchers also noted a cheeky tell: a product-id string “6202033” in the C2 traffic reverses to 3-30-2026, the date of the attack.

2026: the escalation

If 2025 established the techniques, 2026 turned them into a near-monthly cadence. Palo Alto’s Unit 42 frames the September 2025 Shai-Hulud outbreak as the end of npm’s “nuisance era”; since then the frequency and technical depth of compromises have accelerated sharply. A compressed tour of the first half of the year:

  • Worm sequels. April 2026 brought back-to-back wormable campaigns — “Shai-Hulud: The Third Coming” (April 22) and “Mini Shai-Hulud” (April 29), the latter attributed to the actor cluster TeamPCP — both prioritizing theft of npm and GitHub tokens to auto-republish legitimate packages.
  • The axios compromise (March 30-31). Covered above — the single most-downloaded package hit so far, and the clearest 2026 example of an OS-routed macOS RAT.
  • A cross-registry mass event (May 11). A single campaign poisoned 170+ npm packages and 2 PyPI packages — 404 malicious versions — spanning the TanStack router ecosystem, Mistral AI’s SDK suite, UiPath’s automation tooling, and OpenSearch (1.3M weekly npm downloads). It was the first observed campaign to jump npm and PyPI within hours, and notable for pulling AI/ML SDKs into scope to widen the developer net.
  • Microsoft-tracked credential theft (May 28-29). One actor typosquatted OpenSearch, Elastic, and DevOps libraries in 14 packages that harvested AWS credentials, HashiCorp Vault tokens, and CI/CD secrets; a parallel cluster used dependency confusion — 33 packages mirroring real internal corporate namespaces — to quietly profile developer environments for later, selective exploitation.
  • Miasma / the Red Hat namespace (June 1-4). Attackers hijacked the trusted @redhat-cloud-services npm scope (30+ packages) via a compromised GitHub Actions OIDC token — the CI/CD pipeline itself, not a developer account. The “Miasma” worm (a Mini Shai-Hulud variant from TeamPCP) introduced a technique dubbed “Phantom Gyp”: executing through binding.gyp at install time instead of the pre/postinstall hooks security tools usually monitor, then spreading to packages like @vapi-ai/server-sdk and ai-sdk-ollama.

The throughline is consistent: install-time code execution, stolen publish tokens, and CI/CD compromise, now reaching into AI/ML packages and evolving specifically to dodge the monitoring that the 2025 attacks taught defenders to deploy. Many of these payloads are environment-credential harvesters that run wherever they are installed — which, for this developer population, very often means a Mac.

Who actually gets hurt on a Mac

It helps to think in three concentric rings, because the “Macs are safe” belief fails differently in each.

  1. The developer. The direct hit. A poisoned postinstall runs and sweeps the home directory — the same files our notnullOSX analysis documented a stealer reaching for: ~/.ssh/id_*, ~/.aws/, ~/.config/gcloud, ~/.npmrc, ~/.docker/config.json, ~/.gitconfig, browser credential stores, and local wallet files. For a developer with live infrastructure, this is not credential theft; it is supply chain access. Their stolen npm token becomes the next worm’s propagation hop.
  2. The organization. A developer’s Mac is a doorway. The s1ngularity numbers make it concrete: thousands of still-valid GitHub tokens and cloud keys, and private repos turned public. One engineer’s npm install becomes an enterprise breach, feeding the extortion economy described in the 2026 trends report.
  3. The end user who never touched a terminal. The ring most people do not know they are in. When a poisoned package ships inside a desktop app, an Electron app, a browser extension, or a web frontend, its code runs on the end user’s Mac or in their browser session. The @solana/web3.js victims and the chalk/debug crypto-clipper targets were largely ordinary users of crypto apps and websites — not the developers who pulled the dependency. You do not have to use npm to be a victim of npm.

Why the “Macs don’t get this” belief is so sticky and so wrong

The belief persists for a reasonable-sounding reason: Apple’s visible defenses really are good at the threat they were designed for. Gatekeeper and notarization meaningfully reduce drive-by app installs; XProtect catches known families. So a Mac user reasonably concludes the perimeter is held.

The npm supply chain simply is not at that perimeter. It arrives through the package manager, executes as the user, and — in the worm and DPRK cases — is invited in by the victim’s own legitimate activity: building a project, running a take-home assignment, updating an app. None of it looks like “malware” at the moment it runs. As we argued for 2026 broadly, the defining quality of modern Mac threats is that they look trusted, familiar, and routine. A line in package.json is about as routine as it gets.

Final thoughts

Across roughly eighteen months, the same shape recurs: a single compromised human or token, multiplied by the reach of the dependency graph, paying out in stolen credentials and crypto. The payloads grew more sophisticated — from a hardcoded wallet address in the Solana case, to AI-assisted reconnaissance in s1ngularity, to autonomous self-replication in Shai-Hulud, to an OS-routed RAT inside axios — but the macOS exposure was constant. These campaigns ran on Macs because the people who run npm install use Macs, and because Apple’s trust model was never in the loop.

For Mac users, the uncomfortable takeaway is that “I don’t download sketchy software” is no longer a complete defense, because the most active route onto the machine does not involve downloading software in the way Apple’s defenses understand it. The supply chain is now part of every Mac’s attack surface — whether its owner writes code or just runs the apps that other people’s code built.

Practical guidance

For developers on macOS

  • Disable install scripts by default: set ignore-scripts=true in .npmrc and opt in deliberately. This neutralizes the postinstall vector behind most of these campaigns (note the Miasma “Phantom Gyp” variant moved to binding.gyp specifically to dodge this — monitor install-time network egress too).
  • Pin and lock dependencies; review lockfile changes in code review the way you would review source. Consider a cooldown policy that blocks brand-new package versions from installing immediately.
  • Treat any unexpected request to run a “coding assignment,” installer, or demo project as hostile until proven otherwise — this is the Contagious Interview delivery model.
  • Rotate and scope tokens; assume a leaked npm or GitHub token is a propagation vector, not just a credential.
  • Watch for the tells: node_modules postinstall reaching unfamiliar domains, new public repos named after a campaign, TruffleHog appearing where you did not put it, and self-deleting package.json artifacts.

For everyone else

  • Keep crypto apps and wallets updated from official sources, and prefer non-custodial wallets that do not expose private keys to the app layer.
  • Understand that an app’s safety depends on its whole dependency chain, not just its publisher.

Data appendix

Table A — Open-source / npm malware at scale

Metric

Value

Period

Source (link)

New malicious OSS packages (all ecosystems)

454,600+

Full-year 2025

Sonatype 2026 SSSC

New malicious OSS packages

17,954

Q1 2025

Sonatype Q1 2025

New malicious OSS packages

16,279

Q2 2025

Sonatype Q2 2025

New malicious OSS packages

34,319

Q3 2025

Sonatype Q3 2025

YoY growth in detected OSS malware

188%

Q2 2025 vs Q2 2024

Sonatype Q2 2025

Cumulative OSS malware catalogued

1,233,000+

End of 2025

Sonatype 2026 SSSC

Share of new OSS malware from npm

99.8%

Q4 2025

Sonatype Q4 2025

Malware classed as data exfiltration

56% (up from 26%)

Q1 2025 vs Q4 2024

Sonatype Q1 2025

Lazarus-associated packages (97% in npm)

800+

Full-year 2025

Sonatype 2026 SSSC

Repository-abuse surge (one worm campaign)

+53,000%

Q4 2025

Sonatype Q4 2025

Table B — Major npm incidents, 2024-2026, at a glance

Date

Package(s) / campaign

Reach

Exposure

Source (link)

Dec 2024

@solana/web3.js (v1.95.6/.7)

~450K weekly downloads

~5 hrs

GitHub Advisory

Aug 2025

Nx + plugins (s1ngularity)

2,349 secrets; 1,000+ GitHub tokens

~5 hrs

Wiz

Sep 8 2025

chalk, debug + 16 others

2.6B weekly downloads

~2 hrs

Wiz

Sep 2025

Shai-Hulud (worm)

200+ packages / 500+ versions

days

ReversingLabs

Nov 24 2025

Shai-Hulud 2.0 (worm)

796 packages / 20M+ weekly dl

days

Datadog

2023-2026

Contagious Interview (DPRK)

hundreds of pkgs; 338 in one Oct wave

ongoing

Socket

Mar 30-31 2026

axios (v1.14.1/0.30.4)

100M+ weekly downloads

~3 hrs

Microsoft

May 11 2026

TanStack / Mistral / UiPath / OpenSearch

170+ npm pkgs; 404 versions

hours

SafeDep

May 28 2026

OpenSearch/Elastic typosquats

14 pkgs (AWS/Vault/CI secrets)

~4 hrs

Microsoft

Jun 1-4 2026

@redhat-cloud-services (Miasma)

30+ pkgs; spread to @vapi-ai, ai-sdk-ollama

hours

Wiz

Sources & further reading

General reports on malware campaigns

Macro statistics (Sonatype Open Source Malware Index & State of the Software Supply Chain)

@solana/web3.js (December 2024)

Nx “s1ngularity” (August 2025)

chalk / debug (September 8, 2025)

Shai-Hulud worm (September & November 2025)

Contagious Interview / DPRK (ongoing)

axios (March 30-31, 2026)

2026 escalation (Shai-Hulud variants, mass campaigns, Miasma)

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.