npm dependency attacks steal CI/CD secrets by running malicious code during npm install, before any security alert fires. The package accesses environment variables like AWS_ACCESS_KEY_ID or GITHUB_TOKEN and sends them to an external server in milliseconds. In SMEs without context separation, this happens under the same user account that holds production permissions.
The Mechanism Nobody Explains: postinstall as Exfiltration Vector
When you run npm install, npm doesn't just download code — it also executes scripts defined in the installed package's package.json. The most common vector is postinstall, which runs automatically after installation with no visible warning in the terminal. A malicious package can exfiltrate all CI/CD environment secrets in seconds, including GitHub Actions tokens, AWS credentials, NPM tokens, and Docker passwords — all before your actual build step starts.
Why SMEs Are the Ideal Target (Not the Careless One)
The problem isn't negligence — it's structural. The standard CI/CD model taught in every GitHub Actions tutorial installs dependencies in the same context where secrets live. Large enterprises have dedicated teams to sandbox that process and monitor pipeline network traffic. A 3-8 person dev team at an SME simply doesn't, and that's not a failure of diligence — it's a resource reality. What is achievable is knowing the specific risk and applying the three zero-cost controls that any team can implement.
What to Do Right Now (Without Buying Services You Don't Need)
- Replace npm install with npm ci in all CI/CD pipelines
- Commit package-lock.json and remove it from .gitignore
- Run monthly grep audit of postinstall scripts across node_modules
- Replace long-lived tokens with OIDC in GitHub Actions and AWS
- Inventory and rotate API tokens quarterly with minimum required permissions
If your team runs a CI/CD pipeline with npm dependencies and you don't know which tokens are exposed or what scripts run during install, we can do a 2-hour technical review and give you a prioritized risk map. No upsell, no alarmism.
Solicitar diagnóstico