Why NPM v12 won’t stop supply chain attacks
About this episode
The episode discusses the mitigations against supply chain attacks in NPM v12 and the challenges of adoption and effectiveness.
In this podcast episode, James Wilson is joined by Open Source Malware Security co-founder Paul McCarty to talk about the supply chain attack mitigations coming in NPM v12. NPM disabling (by default) auto-run install scripts and dynamic dependencies is a positive step forward… but it’ll take years for this new version to be adopted, and these changes do nothing to prevent malicious packages being imported into projects. Further, Paul thinks disabling these features by default will introduce friction that will cause them to be re-enabled. When the choice is “this builds” and “this is less prone to malware”, the former will always win.
More episodes of Risky Business Features
- Everything is getting much worse, much faster
- Solo podcast: A deep dive on TeamPCP
- How to survive supply chain attacks
- How the CopyFail disclosure went sideways
- NCSC’s Ollie Whitehouse on surviving the "bugpocalypse"
- What a great agentic AI deployment plan looks like
Explore listener stats, chart rankings, contacts and more on the Risky Business Features podcast page.