Post

While the vanity metric is very fun, as 'supply chain attack' news increases, I'm feeling less and less comfortable with the fact that I maintain an npm package with 6M weekly downloads and 2.6k dependents… 😅

Sam Rose

@samwho.dev

You missed a parcel delivery! It has been returned to the depot and you have until Wednesday midday to enter your NPM account email and password into fedex.rhejdirjehrheijrjjfirjrnrjjrjrnj.xyz or we will incinerate it and throw it at you the next time you leave the house.

12/5/26, 2:44 pm0 reposts1 like

Chris Morrell

@cmorrell.com

12 May

But the new attacks are like: - they submit a patch to a project that the makers of my robo-vacuum relies on - they hack a chip supplier who sells chips to a computer vision algo vendor - [45 more steps] - somehow my vacuum issues an npm token to itself and syncs to a random dropbox account