Treat any email that urges you to log in to your registry account, especially with a deadline, as suspect. Do not click it. Type the registry address yourself or use a saved bookmark, check your account settings there, and use a hardware key, which will not work on a lookalike site.
What happened in the 2025 incident
Reporting on the September 2025 npm compromise agrees on the core facts: attackers registered a lookalike domain, npmjs.help, and emailed maintainers as if from npm support. The message said a 2FA update was required and that accounts with outdated credentials would be temporarily locked starting September 10, 2025. One maintainer entered his username, password and one time code on a fake login page, and the attackers used that to publish malicious versions of widely used packages.
The two articles cited below both report 18 affected packages and the September 10 lockout claim. Other coverage may give different counts, so check current reporting before quoting a number.
Signs of a fake
| Sign | Why it matters |
|---|---|
| A deadline with a lockout threat | Urgency is meant to stop you thinking |
| A domain that is close but not the real one | Lookalikes are cheap to register |
| Asks you to log in through the email link | Real sites do not need that |
| Asks for a one time code on a page you reached from an email | A fake page can pass the code straight to the real site |
| Generic wording about "outdated 2FA" | Check what your account actually shows |
Perfect grammar is not evidence of a real message either. See AI written phishing and why perfect grammar is not a clue.
What to do with the email
- Do not click links or open attachments.
- Open a new tab and go to the registry yourself.
- Look at your account notices and security settings.
- Forward the message to the registry's security contact, or to your own security team.
- If you already entered credentials, change your password right away, revoke tokens and sessions, and review recent publishes. Follow your npm package was compromised, a runbook.
Why hardware keys help
A time based one time code can be typed into a fake page and relayed. A WebAuthn security key checks the site address, so it does not complete on a lookalike domain. The GitHub plan for npm says it intends to deprecate TOTP based 2FA in favor of FIDO based 2FA, and recommends WebAuthn over TOTP for maintainers now. That plan gives no dates, so check npm's current documentation. See maintainer 2FA methods ranked.
Reduce the damage if one slips through
Use trusted publishing so there is no token to steal for CI releases, and set a package to require 2FA and disallow tokens. See publish from CI or your laptop.
Safeguard dependency scanning checks what you depend on, and the free scan at gold.safeguard.sh/scan shows what you depend on today.
Quick check
Would a one time code app have stopped this?
Not reliably. In the reported incident a code entered on a fake login page was captured, per the reporting. A security key is harder to relay.
What if the email really is from the registry?
You lose nothing by going to the site yourself and checking your account notices.
Sources
- Security Boulevard: How One Phishing Email Compromised 18 npm Packages
- Kaspersky: Popular npm packages compromised
- GitHub Blog: Our plan for a more secure npm supply chain
Last reviewed: 19 October 2026.
