Supply Chain Attack: The NPM Package That Could Take Down Your Company

## Do You Blindly Trust npm install?

Every time a developer runs `npm install`, they're downloading third-party code that executes with the same permissions as their system. In 2025, malicious NPM package registrations **grew 400%**, according to Sonatype's report.

### Real Cases That Shook the Industry

- **event-stream (2018)**: Package with 2M+ weekly downloads was compromised by a new maintainer who injected a module to steal Bitcoin from wallets.
- **ua-parser-js (2021)**: Package with 8M+ weekly downloads had its account hijacked. Malicious versions mined crypto and stole credentials.
- **Colors.js & Faker.js (2022)**: The author himself sabotaged his widely-used packages in protest, breaking thousands of applications.

### Attack Vectors in Your Pipeline

1. **Typosquatting**: Creating `axois` (typo of `axios`), waiting for someone to mistype.
2. **Dependency Confusion**: Publishing a public package with the same name as a company's private internal package. NPM prioritizes the public one.
3. **Maintainer Compromise**: Stealing the NPM credentials of a legitimate maintainer of a popular package.
4. **Build Script Injection**: `postinstall` scripts that execute arbitrary code during `npm install`.

### Supply Chain Hardening

- **`npm audit` + Snyk/Socket.dev**: Automatic known vulnerability auditing.
- **Strict lockfile**: Always commit `package-lock.json` and use `npm ci` (not `npm install`) in CI/CD.
- **Integrity verification**: `npm config set audit-signatures true`.
- **Dependency policy**: Formal approval to add any new dependency.
- **Build sandbox**: CI/CD in ephemeral containers without access to secrets during install.
- **Version pinning**: NEVER use `"^"` or `"~"` for critical dependencies.

> **At RET, every dependency is treated as untrusted code. We run automated SCA (Software Composition Analysis) on every PR, and new packages go through quarantine before entering the codebase.**