Another npm attack highlights the need for supply-chain security

Estimated reading time: 3 minutes

A fast-moving worm has compromised more than 180 npm packages – and may mark a turning point for software supply chain security

After years of high-profile package compromises – from event-stream to the recent Nx breach – npm is once again in the spotlight. Over the past week, a self-replicating worm has made its way through the world’s largest JavaScript package repository, compromising at least 180 packages and exposing credentials from maintainers and developers along the way. 

Because many of the affected packages sit deep in dependency chains, the attack is likely to have touched thousands of downstream applications and developers – far more than the raw number of packages suggests.

Join LeadDev.com for free to access this content