We first noticed when our package install times tripled overnight.
A self-propagating worm had begun publishing poisoned versions of two extremely popular caching libraries and everything they depended on. Each malicious version, once installed, would scan the victim's project for other published packages in the same namespace and publish new poisoned versions of those too — a chain reaction across the dependency graph.
We pulled the offending versions. We pinned our lockfile. We thought we were done.
We weren't. The worm had already jumped into the transitive deps of a transitive dep of a dev tool nobody had touched in two years. Every time someone ran npm ci on a fresh machine, the infection respawned from a layer we never audited. It survived three full purges because it kept finding new hosts in the dependency tree faster than we could prune them.
The payload itself was a credential skimmer — it read npmrc auth tokens and shipped them out. Within 48 hours, stolen publish tokens were being used to push more poisoned versions under legitimate maintainer accounts.
We eventually contained it by freezing all installs from the public registry for a week and forcing everything through a curated internal mirror with hashes. But the lesson stuck: a worm in a caching library is poetic cruelty. It caches itself.