Package registries have spent 2026 closing the routes attackers relied on, and attackers are already probing execution paths those defenses do not reach.
That is the central finding of a new Intel 471 report covering ten months of software supply chain activity to June 2026.
The hardening has happened over time. Crates.io added a Trusted Publishing Only mode in January, GitHub Actions gained OIDC custom properties to tighten workflow identity scoping in March, and npm 11 shipped minimum release age controls in April. In June, GitHub said npm version 12 would require explicit opt-in for several automatic install behaviors, including dependency lifecycle scripts.
Intel 471 assessed these measures are likely to reduce the reliability of simple install-time execution and long-lived token theft. The problem, the firm noted, is that attackers were never dependent on a single execution path.
A June JFrog report on hijacked npm packages is the clearest illustration. Rather than using npm lifecycle scripts at all, the attackers hid a task set to run automatically on folder open, which fires when the malicious package’s own folder is opened as a trusted VS Code workspace. From there the malware pulled later-stage payloads from blockchain transaction data.
Beyond the Install Script
Other campaigns in the report show the same drift. March’s Axios compromise sidestepped technical controls altogether, with social engineering targeting the lead maintainer yielding credentials used to publish manually.
By May, the node-ipc compromise was skipping install scripts entirely, running only when an application loaded the package at runtime.
June brought two further shifts. StepSecurity found a Miasma wave using a malicious binding.gyp file to move execution into the native build process, a blind spot for scanners that only inspect package.json lifecycle scripts.
The same month, IronWorm campaigns went after the trust mechanism itself, abusing GitHub’s OIDC relationship with npm Trusted Publishing to gain publishing rights without touching a long-lived token.
The Assistant Becomes the Attacker’s Tool
Intel 471 expects that tooling to draw more attacker interest as agent frameworks as well as in-editor helpers accumulate access to repositories, credentials and execution privileges. That shift is already underway.
Socket’s analysis of the SANDWORM_MODE worm in February found it injecting rogue MCP servers into the config files of Claude Desktop, Cursor and Windsurf, using prompt injection to get the assistant itself to gather SSH keys, cloud credentials, and npm tokens.
The Miasma toolkit released publicly in June carried a module dedicated to poisoning those same configurations.
For defenders, Intel 471’s guidance is to watch behavior, not indicators: anomalous publishing, unexpected build script changes, unusual OIDC token requests, forged Git metadata, and releases with no corresponding source artifacts.
