Node Package Managers · Part 10 — Supply-Chain Defense
A concrete defense playbook: ignore-scripts by default, audit, npm provenance and sigstore, scoped tokens with 2FA, minimum release age, SBOMs, lockfile linting, and a hardened CI install.
Filter/Tag
#supply-chain
4 entries
-
-
Node Package Managers · Part 9 — Supply-Chain Attacks
How attackers get code into your node_modules: typosquatting, dependency confusion, malicious postinstall payloads, maintainer account takeover, and protestware — dissected through real npm incidents.
-
Web Security for Frontend Devs · Part 17 — Supply-Chain Attacks via npm install
Bonus track: how a single npm install can run attacker code on your machine — lifecycle scripts, transitive deps, git prepare, bin shadowing — the signals to audit, and a full layered defense. With a live install simulator and exercises.
-
Web Security for Frontend Devs · Part 9 — Secrets, Data Leakage & Supply-Chain
There are no secrets in the browser: env vars, source maps, and third-party scripts leak. Plus npm supply-chain threats — lockfiles, audit, SRI, typosquatting — and practical defenses, with exercises.