Snyk: Critical NPM Supply Chain Attack Response Guide

Name: Snyk: Critical NPM Supply Chain Attack Response Guide
Uploaded: 2026-06-17T11:47:51-04:00
Duration: 48 s
Description: TL;DR Any environment that installed et10 stack/router family packages on May 11th should be treated as compromised and checked for the router_init.js file in the tarball Remediation must follow a specific order: disable the dead man switch and remove ...

Snyk

06/17/2026

0 (0%)

Report Like Favorite

TL;DR

Any environment that installed et10 stack/router family packages on May 11th should be treated as compromised and checked for the router_init.js file in the tarball
Remediation must follow a specific order: disable the dead man switch and remove persistent hooks before rotating credentials to prevent triggering home directory destruction
Two configuration changes provide protection: set minimum NPM release age to 7 days and pin OIDC trusted publisher config to specific branch and workflow file

Summary

This urgent security advisory addresses a critical supply chain attack targeting the et10 stack/router family of NPM packages on May 11th. The video provides immediate response guidance for potentially compromised environments, emphasizing the importance of proper remediation sequencing to prevent data loss. Key protective measures include implementing a 7-day minimum release age in NPM configurations and restricting OIDC trusted publisher settings to specific branches and workflow files rather than entire repositories. The guidance is particularly relevant for development teams using affected packages in production environments, as the attack included sophisticated persistence mechanisms and destructive capabilities that could be triggered by premature credential rotation.

Chapters

0:00 - Compromise Assessment
0:09 - Remediation Sequence
0:23 - Preventive Configuration
0:37 - Additional Resources

Key Quotes

0:00 "If you installed any et10 stack slash router family package on May 11th, treat that environment as compromised."
0:15 "The remediation order matters. Kill the dead man switch and remove editor persistent hooks before you rotate any credentials."
0:27 "Set minimum release age to 7 in your npmrc configuration file and pin your oidc trusted publisher config to a specific branch and workflow file, not just a repository."

FAQ

How do I check if my environment was affected by the et10 stack/router attack?

Check for the router_init.js file in the tarball of any et10 stack/router family packages installed on May 11th. If present, treat that environment as compromised and follow the remediation steps in the proper sequence.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

Aligning Agentic Intent: Understanding Your Agents' True Potential and Performance

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

Agentic Shopping Trends: Insights on Muse and the 2026 Holiday Season

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.