Snyk: Credential Rotation Priority After npm Security Breach

Name: Snyk: Credential Rotation Priority After npm Security Breach
Uploaded: 2026-06-17T11:47:51-04:00
Duration: 1 min 5 s
Description: TL;DR Rotate npm publish tokens and OIDC federation grants first, as these pose the highest risk for malicious package distribution from affected repositories. If you used Claude Code and ran npm install on an affected version, treat all session histor...

Snyk

06/17/2026

0 (0%)

Report Like Favorite

TL;DR

Rotate npm publish tokens and OIDC federation grants first, as these pose the highest risk for malicious package distribution from affected repositories.
If you used Claude Code and ran npm install on an affected version, treat all session history data as compromised, including commands, API keys, and code.
Follow the seven-tier priority order for credential rotation, starting with publishing credentials and working through GitHub tokens, cloud credentials, and SSH keys.

Summary

This security advisory provides a prioritized credential rotation checklist for developers affected by a malicious npm package incident. The guidance focuses on credentials most at risk of compromise, starting with npm publish tokens and OIDC federation grants, followed by GitHub access tokens, AWS credentials, HashiCorp Vault tokens, Kubernetes service account tokens, SSH private keys, and GCP service account credentials. The video highlights a critical threat specific to Claude Code users, as the malware targeted session history files that may contain commands, API keys, and code snippets. Organizations are advised to treat all data from affected Claude Code sessions as potentially compromised and to re-establish OIDC federation grants only after confirming publishing workflows are secure.

Chapters

0:00 - Credential Rotation Priority
0:09 - Publishing Credentials First
0:20 - Cloud and Infrastructure Tokens
0:38 - Claude Code Specific Threat

Key Quotes

0:04 "Start with the credentials that could be used to push malicious packages or access your most sensitive infrastructure."
0:38 "The worm specifically targeted claude code session history files at claude projects file. It's a .jsonl file."
0:49 "If you use claude code and ran npm install on an affected version, treat anything that appeared in your claude code sessions as potentially harvested."

FAQ

Why are npm publish tokens the highest priority for rotation?

npm publish tokens and OIDC federation grants are prioritized first because they could be used to push malicious packages to the npm registry, potentially affecting downstream users and creating a supply chain attack vector.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Illumio + Netskope: Zero Trust in the Age of AI Autonomy

Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

Becoming Agent Ready: Insights from Cyera's Expertise