AI Agent Supply Chain Attacks: How Dependencies Become Weapons

AI agent supply chain attacks turn trusted npm dependencies into weapons. How dependency hijacking works, the Shai-Hulud campaign, and how to protect yourself.

🛡️ ClawSecure Team

Every OpenClaw skill you install carries a hidden cargo of third-party code. A typical skill depends on dozens of npm packages, each of which depends on dozens more. That chain of trust stretching from your machine to a package maintained by a stranger on the internet is the supply chain, and in 2025 it became the most exploited attack vector in the JavaScript ecosystem. For anyone running AI agent skills built on Node.js, understanding AI agent supply chain attacks is no longer optional. It is a prerequisite for safe operation.

What Is an AI Agent Supply Chain Attack?

An AI agent supply chain attack targets the dependencies that agent skills rely on rather than the skill code itself. Instead of writing malicious skill code and hoping someone installs it, attackers compromise a trusted upstream npm package. Every downstream consumer, including OpenClaw skills, automatically inherits the malicious payload the next time they install or update.

This approach is devastatingly efficient. A single compromised npm package with millions of weekly downloads can propagate malicious code to thousands of developers and automated build systems within hours. For AI agent ecosystems like OpenClaw, the stakes are even higher. Skills run with broad system permissions including file access, clipboard control, shell execution, and network requests. An npm dependency attack that compromises a skill dependency gains access to everything that skill can touch on your machine.

The OWASP Top 10 for Agentic Applications identifies supply chain compromise as a core agentic security risk precisely because of this amplification effect. Agents operate with autonomy across systems, and a single poisoned dependency can turn a trusted skill into an attack platform. ClawSecure covers this risk through our 3-Layer Audit Protocol, which includes dedicated supply chain vulnerability scanning across every dependency in the tree.

The Shai-Hulud Campaign: A Case Study in npm Dependency Attacks

The most significant AI agent supply chain attack in recent history unfolded across late 2025 in two devastating waves. The Shai-Hulud campaign, named after the sandworms in Frank Herbert’s Dune, demonstrated exactly how dependency hijacking targets the software supply chain at scale.

The first wave struck in September 2025 when attackers compromised 18 widely-used npm packages including foundational libraries like chalk and debug. These packages collectively see billions of downloads each week. The attack began with a targeted phishing email that tricked a package maintainer into revealing their credentials. Within hours, attackers published malicious versions containing cryptocurrency-stealing code. Malicious versions were live for approximately two hours before detection, but the blast radius was enormous.

One week later, a self-replicating worm variant appeared. This malware, documented extensively by Palo Alto Networks Unit 42, stole developer credentials, created public GitHub repositories containing the stolen secrets, and then used stolen npm tokens to inject malicious code into other packages maintained by the victim. The worm spread autonomously, compromising over 500 packages. CISA issued a federal security advisory about the campaign in September 2025.

The second wave, dubbed Shai-Hulud 2.0, escalated dramatically in November 2025. Attackers shifted execution from the postinstall phase to the preinstall phase, meaning malicious code ran before the package even finished installing. This wave compromised over 700 npm packages and created more than 25,000 malicious GitHub repositories. It also introduced a destructive failsafe mechanism: if the malware detected containment or analysis, it attempted to destroy the user’s home directory. npm responded by revoking all classic authentication tokens in December 2025 and migrating to shorter-lived granular tokens.

How Supply Chain Rug Pulls Target AI Agent Skills

A supply chain rug pull in the AI agent context follows a specific pattern. A skill depends on Package A, which depends on Package B, which depends on Package C maintained by a single developer. If that developer’s credentials are compromised or the package is sold to a malicious actor, every skill in the dependency tree inherits the problem.

OpenClaw skills are particularly vulnerable to this attack pattern for several reasons. First, skills run with broad system-level permissions. An AI agent skill that accesses your file system, clipboard, and shell has far more attack surface than a typical web application component. Second, many skills use unpinned dependency versions, meaning they automatically pull the latest version of every package on installation. If a dependency is compromised between version 1.2.3 and 1.2.4, unpinned installations silently adopt the malicious update. ClawSecure’s audit of 2,890+ skills from the community-curated awesome-openclaw-skills list found that 99.3% ship without a config.json permissions manifest, indicating minimal dependency governance at the ecosystem level.

Third, the update cadence of AI agent skills creates persistent exposure windows. Unlike traditional software with scheduled release cycles, OpenClaw skills are frequently updated by individual developers. Each update is an opportunity for a compromised dependency to enter the supply chain, and the window between compromise and detection can be measured in hours to days.

Dependency Hijacking Methods Targeting AI Agents

Attackers use several proven techniques for dependency hijacking in AI agent ecosystems:

Typosquatting involves publishing packages with names similar to popular libraries. A developer who types “axois” instead of “axios” installs a malicious package that mirrors the legitimate one’s functionality while exfiltrating credentials in the background. This technique targets automated installation scripts and CI/CD pipelines where typos slip through review.

Account compromise is the method used in the Shai-Hulud campaign. Attackers phish maintainer credentials and publish malicious updates under the trusted package name. Because the update comes from the legitimate maintainer account, it bypasses most review processes. This is the most dangerous form of npm dependency attack because the package name, version history, and download count all appear legitimate.

Dependency confusion exploits naming conflicts between public and private registries. If an organization uses internal packages with names that don’t exist on the public npm registry, an attacker can publish a package with that name on npm. Build systems configured to check both registries may pull the public malicious version instead of the private legitimate one.

Maintainer takeover targets abandoned but still-downloaded packages. Attackers contact the original maintainer offering to help maintain the package, gain publishing rights, and inject malicious code into a minor update that most consumers accept automatically.

Why Traditional Security Tools Miss Supply Chain Threats

Generic malware scanners examine skill code for known malicious signatures, but supply chain attacks bypass this entirely. The skill code itself is clean. The malicious payload lives one, two, or three levels deep in the dependency tree, inside an npm package that passed every static analysis check when it was originally published.

This is exactly why OpenClaw supply chain security requires dedicated dependency scanning as a separate security layer. Checking skill source code alone covers the surface. Checking every package in the full dependency tree covers the supply chain. These are fundamentally different operations requiring different tools and methodologies.

ClawSecure’s 3-Layer Audit Protocol addresses this gap directly. Layer 3 performs full dependency tree scanning against the OSV vulnerability database, checking every npm package in a skill’s dependency chain against known CVEs. Across 2,890+ audited skills, Layer 3 detected 163 supply chain findings, representing 1.7% of all security findings. That percentage reflects the Python-centric architecture of many OpenClaw skills, but for Node.js-heavy skills with deep dependency trees, supply chain vulnerabilities are among the most critical findings.

Protecting Your OpenClaw Skills from Supply Chain Attacks

Defending against AI agent supply chain attacks requires action at multiple levels. For users installing OpenClaw skills, the most immediate protection is scanning before installing. A security audit that includes dependency scanning will flag known CVEs in the supply chain before they execute on your machine.

Pin your dependencies. Use exact version numbers in package.json and commit your package-lock.json file. This prevents automatic adoption of compromised minor or patch updates. When you do update dependencies, review the changelog and check the package against vulnerability databases before accepting the new version.

Monitor for post-installation changes. A skill that passed a supply chain audit today may pull in a compromised dependency update tomorrow. This is the sleeper agent problem applied to the dependency layer, and it is why continuous monitoring matters as much as point-in-time scanning. ClawSecure’s Watchtower system monitors audited skills 24/7, detecting code changes including dependency updates and automatically re-scanning when drift is detected.

For skill creators, the most impactful step is minimizing your dependency surface. Every package you add to your skill is code you’re asking users to trust. Audit your dependency tree with npm ls and remove packages you don’t actively use. Replace heavy libraries with lightweight alternatives where possible. Declare your skill’s required permissions in a config.json manifest so users and security tools can verify your skill requests only what it needs.

Enable multi-factor authentication on your npm account and use scoped, short-lived publishing tokens. The Shai-Hulud campaign succeeded because stolen long-lived tokens granted unlimited publishing access. The npm ecosystem’s December 2025 migration to granular tokens was a direct response to this failure mode.

How ClawSecure Detects AI Agent Supply Chain Attacks

ClawSecure’s approach to OpenClaw supply chain security combines three complementary detection methods. The proprietary behavioral engine (Layer 1) identifies skill-level indicators of supply chain compromise including ClawHavoc malware patterns such as command-and-control callbacks, credential harvesting, and data exfiltration endpoints. These patterns often indicate that a skill has been compromised through its dependency chain rather than through direct code modification.

Industry-standard code analysis (Layer 2) performs static and behavioral analysis across all skill code files, tracing execution paths and data flows to detect the Lethal Trifecta of agentic risks identified by Palo Alto Networks (2026): Data Access, Untrusted Content, and Tool Execution. When a supply chain compromise introduces new execution paths or data flows into a previously clean skill, behavioral analysis surfaces the anomaly.

Supply chain scanning (Layer 3) performs full dependency tree analysis against known vulnerability databases, flagging every npm package with a published CVE. This layer catches the known-bad packages that traditional skill scanners miss entirely because they never look past the top-level code.

Together, these three layers provide defense in depth against supply chain attacks at every level: the skill code, the behavioral patterns, and the dependencies themselves. With 2,890+ skills audited from the community-curated awesome-openclaw-skills list and the openclaw/skills repository, ClawSecure maintains the largest public security analysis of the OpenClaw ecosystem’s supply chain exposure.