Malicious dependencies increasingly execute on developer computers—the same machines that hold SSH keys, passwords, tokens, and production access. Reduce the value and lifetime of what an attacker can steal.
Recent npm incidents
These incidents differed in entry point and payload, but each showed how routine package installation can become credential theft at software-distribution speed.
Developer workstations and CI
Malicious Nx releases ran an install-time payload on Linux and macOS. Researchers reported collection of GitHub and npm tokens, environment files, cloud credentials, and SSH keys; stolen GitHub tokens were later used to expose thousands of private repositories.
Read Wiz Research500+ compromised packages
A self-replicating npm worm harvested developer and CI credentials, published compromised versions of other maintainer packages, and placed stolen secrets in public GitHub repositories. CISA urged organisations to rotate developer credentials.
Read CISA alert25,000+ malicious repositories reported
The renewed campaign moved execution to pre-install, targeted developer machines and build systems, stole cloud and developer credentials, and added destructive behaviour when exfiltration failed.
Read Unit 42Counts are attributed to the linked incident reports and may change as investigations are updated. Package download volume or repository count is not the same as a confirmed victim count.
The credential problem
Reimaging an infected workstation removes malware. It does not revoke a private SSH key already exfiltrated, rotate a shared server password, or tell you every machine where its matching credential remains valid.
Incident response becomes credential archaeology: identify every secret the developer could read, every server it could unlock, and every unmanaged copy that must be replaced.
Contain the second hop
A copied SSH certificate has a configured expiry. It does not remain useful for years like a persistent private key or shared password can.
Engineers authenticate through the company identity provider before Flotte evaluates whether they may receive a certificate.
Disable future certificate issuance centrally after an endpoint incident, without first locating a copied public key on every managed server.
Limit which managed servers each identity can reach instead of letting one workstation credential silently accumulate broad access.
As malware becomes more sophisticated, organisations should be prepared for an employee device to be compromised. Flotte helps reduce the infrastructure blast radius and makes SSH access cleanup faster by replacing persistent credentials with scoped, short-lived access.
If an engineer's private key is leaked, the key alone does not grant access to Flotte-managed servers. It requires a valid SSH certificate issued for that key. A stolen key and certificate can only be used within the certificate's configured lifetime, while future issuance can be revoked centrally.