Tag
The packages you trust most are the most valuable to compromise — because they are everywhere. Here is how a tainted dependency reaches your users, and how to limit the damage.
One phishing email reached one maintainer, and malicious versions of packages with billions of weekly downloads went live. Here is the story and the practical lesson for your own builds.
You keep seeing CVE-2024-something in advisories and dependency warnings. Here is what that ID actually is — and the more useful question of whether it touches you.
Most supply-chain incidents are a single bad package. Shai-Hulud was different: it used what it stole to publish itself into more packages, on its own.
Most dependency supply-chain risk is blunted by three boring npm settings. They are not glamorous, but they remove the easy ways a bad package slips in.
Your app ships dozens of packages you never chose. When one gets hijacked, you ship the attack too. Here is the pattern, the big recent incidents, and the defenses.