NPM's defenses against supply-chain attacks, introduced following the Shai-Hulud incidents, have significant vulnerabilities that allow hackers to bypass security through Git dependencies. Known as PackageGate, these weaknesses affect several JavaScript dependency management tools, including pnpm, vlt, Bun, and NPM itself. Koi Security discovered these flaws and reported them, but NPM rejected the findings, claiming the behavior "works as expected." In contrast, other package managers quickly patched their vulnerabilities. The Shai-Hulud attack initially compromised 187 packages in September 2025, with a second wave affecting 500 packages and exposing 400,000 developer secrets across 30,000 GitHub repositories. In response, GitHub recommended disabling lifecycle scripts during installation and enabling lockfile integrity and dependency pinning. However, Koi researchers demonstrated how malicious configuration files could still execute code even with these safeguards in place. While Bun and vlt promptly addressed their issues, NPM's lack of action has raised concerns. Koi's attempts to engage with NPM through their HackerOne bug bounty program were ignored, emphasizing the responsibility placed on users to vet package content. GitHub acknowledged the importance of community cooperation in securing the NPM ecosystem and is actively scanning for malware.