Credential theft via npm preinstall attacks is an emerging and widespread threat in software supply chains. Attackers exploit npm package preinstall scripts to silently steal credentials, affecting over 25,000 repositories. External Attack Surface Management (EASM) helps organisations discover vulnerable packages, monitor exposed assets, and respond quickly to such threats. DarkInvader’s EASM platform provides vital visibility and mitigation capabilities to safeguard credentials and reduce attack surface risks today.