The break is not in the app code. These packages execute during npm install, before anyone trusts or uses them, and they go straight for cloud and CI secrets on the build host. That turns dependency installation into a credential theft point and gives attackers a foothold for downstream supply-chain abuse.
Microsoft says one actor published 14 malicious typosquatted npm packages in a four-hour window, all tied to the same install-time stager and a Bun-compiled second stage. The packages target AWS credentials, HashiCorp Vault tokens, GitHub Actions secrets, and npm publish tokens, and the affected repos and users have been taken down.
The risk is broader than one bad package. If a developer or CI machine holds reusable cloud or publishing secrets, install-time trust is enough to hand them over, even before the dependency is imported or reviewed.