[montague27]

Is there an increasing trend of supply chain attacks? What can developers do to mitigate the impact?

[HighGoldstein]

Mitigate? Stop using random packages. Prevent? Stop using NPM and similar package ecosystems altogether.

[cromka]

That package wasn't any more random than any other NodeJS package. NPM isn't inherently different from, say, Debian repositories, except the latter have oversight and stewardship and scrutiny.

That's what's needed and I am seriously surprised NPM is trusted like it is. And I am seriously surprised developers aren't afraid of being sued for shipping malware to people.

[metaltyphoon]

> and similar package ecosystems altogether

Realistically, this is impossible.

[anthk]

Does this happen with CPAN?

At least they seemed to have policies:

https://security.metacpan.org/

[christophilus]

Review and vendor your dependencies like it’s 1999.

[hakcermani]

Are many of the packages obfuscated? Seems like here the server url was heavily obfuscated and encrypted, that is a big warning flag is it not. Auto scanning a submitted package and flagging off obfuscated / binary payloads / install scripts for further inspection could help. Am wondering how such packages get automatically promoted for distribution ..

[embedding-shape]

If you have to run it regardless, contain it as good as you could, given the potential impact. If you're not using the same machine for anything else, maybe "good riddance" is the way to go? Otherwise try to sandbox it, understanding the tradeoffs and (still) risks. Easiest for now is just run everything in rootless podman containers (or similar), which is relatively easy. Otherwise VMs, or other machines. All depends on what effort you feel is worth it, so really what it is your are protecting.

[throw-12-16]

Yes, and even more so now that we are vibe coding codebases with piles of random deps that nobody even bothers to look at.

You can mitigate it by fully containerizing your dev env, locking your deps, enabling security scans, and manually updating your deps on a lagging schedule.

Never use npm global deps, pretty much the worst thing you can do in this situation.

[spot]

use dependabot with cooldown.