[gdotdesign]

- There is a single root dependency somewhere which gets overtaken

- A new version of this dependency is published

- A CI somewhere of another NPM package uses this new version dependency in a build, which trigger propagation by creating a new modified version of this dependency?

- And so on...

Am I getting this right?

[chasd00]

I think so. It’s that third step that I can’t figure out. Build systems are configured to pull the latest version of a dep automatically, without review, and then publish. It seems the poorly configured pipelines are what enable these attacks. Fix your pipelines