Post

While the vanity metric is very fun, as 'supply chain attack' news increases, I'm feeling less and less comfortable with the fact that I maintain an npm package with 6M weekly downloads and 2.6k dependents… 😅

12/5/26, 2:42 pm0 reposts9 likes

aSyd🪿

@dysphoric.dev

12 May

today's news makes me feel better about the lack of technical fanciness in my npm package CI setups. They don't do much, and could probably be a lot faster, but at least they don't have much attack surface

Sam Rose

@samwho.dev

12 May

You missed a parcel delivery! It has been returned to the depot and you have until Wednesday midday to enter your NPM account email and password into fedex.rhejdirjehrheijrjjfirjrnrjjrjrnj.xyz or we will incinerate it and throw it at you the next time you leave the house.

Chris Morrell

@cmorrell.com

12 May

But the new attacks are like: - they submit a patch to a project that the makers of my robo-vacuum relies on - they hack a chip supplier who sells chips to a computer vision algo vendor - [45 more steps] - somehow my vacuum issues an npm token to itself and syncs to a random dropbox account