Skip to content
Back to blog
Guides

npm Supply Chain Attacks Explained

The common patterns behind npm supply chain attacks — compromised maintainer accounts, typosquatting, and malicious postinstall scripts — and how to defend against each.

S
SecureScout Team· Security Engineering
July 31, 20266 min read

The npm ecosystem's openness is exactly what makes it powerful — and exactly what makes it a recurring target for supply chain attacks that exploit trust in the dependency chain itself.

Compromised maintainer accounts

A legitimate, widely-used package can be compromised if an attacker gains access to the maintainer's npm account — often via credential stuffing or a phishing attack unrelated to the package's code quality. The attacker then publishes a malicious version under the real package's trusted name, and anyone who updates without pinning receives it automatically.

Defense: Pin exact dependency versions in your lockfile, and don't auto-update without review. Encourage (or require, for internal packages) maintainer 2FA.

Typosquatting

Attackers publish packages with names deliberately similar to popular ones (lodahs instead of lodash), betting on developer typos during manual installation.

Defense: Use autocomplete-aware tooling, review new dependencies before adding them, and consider a private registry proxy that can flag unusually-named new packages.

Malicious postinstall scripts

npm packages can define scripts that run automatically during installation — including postinstall — with the same permissions as whoever ran npm install. A malicious package can use this to exfiltrate environment variables, credentials, or SSH keys the moment it's installed, without the code ever needing to be imported or executed by the application itself.

Defense: Consider running npm install --ignore-scripts in CI where feasible, and review postinstall scripts for new or unfamiliar dependencies before allowing them.

Dependency confusion

Covered in more depth elsewhere, but worth noting here: an attacker publishing a public package matching an internal private package's name, exploiting registry resolution order.

Practical defenses across all of these

  1. Lockfiles, always committed and enforced in CI (npm ci, not npm install).
  2. Software composition analysis scanning for known-malicious or known-vulnerable packages.
  3. Minimize dependency count — every dependency, and every transitive dependency it pulls in, is additional trust you're extending.
  4. Review before upgrading major/unfamiliar packages, rather than blindly accepting Dependabot-style auto-merge for everything.

Supply chain security in npm isn't about avoiding open source — it's about treating every dependency addition as extending trust to code you didn't write and haven't reviewed, and applying just enough friction to that decision.

npmsupply-chainopen-source

Frequently Asked Questions

Are postinstall scripts inherently malicious?

No — many legitimate packages use them for necessary build steps like compiling native bindings. The risk is that they run automatically with the same permissions as the install process, without you reviewing the code first.

Does using a lockfile fully protect against supply chain attacks?

It protects against unexpected version changes between installs, but not against a malicious update being published to a version you haven't yet pinned to, or a compromise introduced before your lockfile was generated.

Related Articles

S

SecureScout Team

Security Engineering

Learn more →