Response to verified compromised npm build exposure

The 19 October 2026 analysis described the affected-version lists for Chalk, Debug, and Shai-Hulud as evolving and warned that package-name-only inventories are inadequate.

It cited [email protected] and [email protected] as examples of why exact version matching matters, while the audit found that the complete authoritative mapping was missing.

The response is therefore event-driven: act immediately when an exact package-name, version, and integrity-hash intersection is independently verified, rather than waiting for a package-name-only assessment or treating the examples as exhaustive.

Npm release teams are affected when a build is independently verified to contain an affected Chalk, Debug, or Shai-Hulud package name, exact version, and integrity hash; they must stop the intersecting release and rebuild it.

CI/CD operators responsible for runners, package caches, container layers, and build artifacts touched by that build must isolate relevant infrastructure and preserve evidence. Owners of credentials and signing assets reachable by the affected build identities must rotate or replace those assets.

Downstream release and provenance teams must reassess artifacts produced in the affected environment because a prior valid signature alone does not establish cleanliness.

Teams that know only that they use npm, or that see [email protected] or [email protected] without a verified integrity-hash match, cannot determine exposure from this packet alone.

Direct support — The 19 October 2026 supply-chain analyst excerpt says to inventory package name, exact version, and integrity hash; inspect lockfiles, SBOMs, workspaces, package caches, container layers, build artifacts, and transitive dependencies; and immediately stop intersecting releases.

It names [email protected] and [email protected] as examples showing why exact matching matters.

Direct support — The evidence auditor confirmed that the cited analysis explicitly supports quarantining runners, caches, and artifacts; preserving forensic material; rotating credentials and signing assets reachable by affected runners; and rebuilding from known-good inputs on clean infrastructure.

Scope support — The decision scout limited the procedure to exact dependency tuples and assets reachable from affected execution identities. Evidence gap — A second audit finding says the incident-specific advisories and primary sources were not included.

Evidence gap — A third audit finding says two examples and evolving lists are insufficient to determine exposure without a complete package-version-hash map.

The supply-chain analyst’s 19 October 2026 analysis called for matching npm exposure by package name, exact version, and integrity hash, then stopping intersecting releases and containing the build environment.

The decision scout framed that guidance as an operational response for Chalk, Debug, and Shai-Hulud exposure.

The evidence auditor found direct support for the response procedure but identified two gaps: the cited primary advisories were not included, and the packet lacked a complete affected package-version-hash map.

The boundary reviewer therefore rejected wording that would treat every named release set as independently established by this packet. The arbiter resolved the issue by making independent verification of an exact tuple the trigger for action.

The record-linking role found no prior decision available for comparison, so the selected outcome was a new operational record rather than an update.