Snyk: Critical NPM Supply Chain Attack Response Guide

Name: Snyk: Critical NPM Supply Chain Attack Response Guide
Uploaded: 2026-06-17T11:47:51-04:00
Duration: 48 s
Description: TL;DR Any environment that installed et10 stack/router family packages on May 11th should be treated as compromised and checked for the router_init.js file in the tarball Remediation must follow a specific order: disable the dead man switch and remove ...

Snyk

06/17/2026

0 (0%)

Report Like Favorite

TL;DR

Any environment that installed et10 stack/router family packages on May 11th should be treated as compromised and checked for the router_init.js file in the tarball
Remediation must follow a specific order: disable the dead man switch and remove persistent hooks before rotating credentials to prevent triggering home directory destruction
Two configuration changes provide protection: set minimum NPM release age to 7 days and pin OIDC trusted publisher config to specific branch and workflow file

Summary

This urgent security advisory addresses a critical supply chain attack targeting the et10 stack/router family of NPM packages on May 11th. The video provides immediate response guidance for potentially compromised environments, emphasizing the importance of proper remediation sequencing to prevent data loss. Key protective measures include implementing a 7-day minimum release age in NPM configurations and restricting OIDC trusted publisher settings to specific branches and workflow files rather than entire repositories. The guidance is particularly relevant for development teams using affected packages in production environments, as the attack included sophisticated persistence mechanisms and destructive capabilities that could be triggered by premature credential rotation.

Chapters

0:00 - Compromise Assessment
0:09 - Remediation Sequence
0:23 - Preventive Configuration
0:37 - Additional Resources

Key Quotes

0:00 "If you installed any et10 stack slash router family package on May 11th, treat that environment as compromised."
0:15 "The remediation order matters. Kill the dead man switch and remove editor persistent hooks before you rotate any credentials."
0:27 "Set minimum release age to 7 in your npmrc configuration file and pin your oidc trusted publisher config to a specific branch and workflow file, not just a repository."

FAQ

How do I check if my environment was affected by the et10 stack/router attack?

Check for the router_init.js file in the tarball of any et10 stack/router family packages installed on May 11th. If present, treat that environment as compromised and follow the remediation steps in the proper sequence.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Discover DLP Memories: The ever-evolving triage agent enhancing efficiency each shift.

Safeguarding Sensitive Data in the Era of Public AI Platforms

AI Agents Revolutionizing Identity Attacks: Same Tactics, Enhanced Speed