How NPM Auto-Updates & Post-Install Scripts Could Hijack Your Org
From Modern Web by Modern Web
October 7, 2025 · 36 min
About this episode
This episode discusses recent NPM supply chain attacks and practical defenses for securing the JavaScript ecosystem.
In this Modern Web Podcast, Rob Ocel and Danny Thompson break down the recent string of NPM supply chain attacks that have shaken the JavaScript ecosystem. They cover the NX compromise, the phishing campaign that hit libraries like Chalk, and the Shy Halood exploit, showing how small changes in dependencies can have massive effects. Along the way, they share practical defenses like using package lock and npm ci, avoiding phishing links, reviewing third party code, applying least privilege, staging deployments, and maintaining incident response plans. They also highlight vendor interventions such as Vercel blocking malicious deployments and stress why companies must support open source maintainers if the ecosystem is to remain secure. Key Points from this Episode: - Lock down installs. Pin versions, commit package-lock.json, use npm ci in CI, and disable scripts in CI (npm config set ignore-scripts true) to neutralize post-install attacks. - Harden people & permissions. Phishing hygiene (never click-through emails), 2FA/hardware keys, least-privilege by default, and separate/purpose-scoped publishing accounts. - Stage & detect early. Canary/staged deploys, feature flags…
People in this episode
Host: Rob Ocel
Guest: Danny Thompson
Topics covered
- NPM supply chain attacks
- JavaScript ecosystem security
- dependency management
- phishing prevention
- incident response
Keywords
- NPM
- supply chain attacks
- JavaScript
- phishing
- incident response
- dependencies
- security
Mentioned in this episode
Organizations: NPM, Chalk, Vercel, JavaScript
More episodes of Modern Web
- Improving AI Assisted Development with Minko Gechev · June 5, 2026 · 38 min
- Databases at Extreme Scale (PlanetScale CEO Sam Lambert) · January 8, 2026 · 48 min
- How Varlock Fixes .env Vulnerabilities and Secures Your Secrets · December 10, 2025 · 41 min
- The One Mindset That Will 10x Your Dev Career (and Keep You Ahead of AI) · October 21, 2025 · 32 min
- The Cloud Built AI. Can It Survive What AI Needs Next? · October 14, 2025 · 34 min
- Cracking Tech Interviews When AI Changes the Rules · October 1, 2025 · 48 min
Explore listener stats, chart rankings, contacts and more on the Modern Web podcast page.