Are npm supply chain attacks making you rethink dependency…
1 reactions
Are npm supply chain attacks making you rethink dependency trust?
The npm ecosystem has had a rough \~10 months, and honestly, it’s starting to feel a bit fragile.
Quick recap of some major incidents:
* GlueStack ecosystem attack (June 2025): attackers used stolen tokens to inject code that could run shell commands, take screenshots, and exfiltrate files
* Chalk & Debug hijack (Sept 2025): phishing attack → maintainer account takeover → crypto-stealing payloads
* Shai-Hulud worm (Nov 2025): self-propagating malware that spread via stolen GitHub/npm tokens, eventually hitting 492 packages
* Axios RAT injection (Mar 2026): compromised maintainer account → trojanized versions targeting multiple OS
At least two of these affected me directly (both personal and professional projects). I updated dependencies as advised, but months later, new vulnerabilities still keep surfacing.
It feels like even when you do the “right thing,” you’re still exposed.
**How has this changed your approach to dependency management?**
Are you doing anything differently now (pinning, auditing, reducing deps, internal mirrors, etc.)?
#dev #programming #technology #js
The npm ecosystem has had a rough \~10 months, and honestly, it’s starting to feel a bit fragile.
Quick recap of some major incidents:
* GlueStack ecosystem attack (June 2025): attackers used stolen tokens to inject code that could run shell commands, take screenshots, and exfiltrate files
* Chalk & Debug hijack (Sept 2025): phishing attack → maintainer account takeover → crypto-stealing payloads
* Shai-Hulud worm (Nov 2025): self-propagating malware that spread via stolen GitHub/npm tokens, eventually hitting 492 packages
* Axios RAT injection (Mar 2026): compromised maintainer account → trojanized versions targeting multiple OS
At least two of these affected me directly (both personal and professional projects). I updated dependencies as advised, but months later, new vulnerabilities still keep surfacing.
It feels like even when you do the “right thing,” you’re still exposed.
**How has this changed your approach to dependency management?**
Are you doing anything differently now (pinning, auditing, reducing deps, internal mirrors, etc.)?
#dev #programming #technology #js
1
| 3,000 mlx | |
| 2 | |
| 1 |