In September, the world of JavaScript developers was again at the center of a high-profile scandal. npm, the largest package registry, experienced one of the most massive attacks in recent years: several popular libraries were compromised and distributed malicious code.
Such cases are not new, but each time they remind us: modern development is not only code, but also supply chain security (supply chain security). Let's figure out what happened and what lessons are worth learning.
What happened?
Hackers gained access to the accounts of the maintainers of several widely used packages. They added code inside the updates that:
stole tokens and data from the developers' environment;
could be used to attack CI/CD systems;
allowed to install additional malicious dependencies.
The main problem is that many projects automatically update packages. As a result, thousands of developers and companies were hit in just a few hours.
Why is it so dangerous?
Popularity of packages — one vulnerable package can drag hundreds of others along with it.
Automation — CI/CD without manual dependency checks is an ideal target for attack.
Trust in open source — if attackers infiltrate updates, code transparency becomes a vulnerability.
What lessons are worth taking:
1. Minimize dependencies
Fewer packages mean less risk. Sometimes 10 lines of your own code are more reliable than installing a new library.
2. Enable version locking
Use package-lock.json or npm shrinkwrap to make updates only manually, after checking.
3. Check the maintainers
Keep an eye on activity: sudden changes in owners or suspicious commits are a red flag.
4. Set up monitoring
Tools like npm audit, Snyk, or GitHub Dependabot will help you find vulnerabilities faster.
5. Protect CI/CD
Keep secrets in secure vaults (Vault, Secret Manager), use the principle of least privilege and isolation of environments.
Where is the ecosystem moving?
After the incident, npm and GitHub tightened their controls:
mandatory two-factor authentication for maintainers,
improved mechanisms for warning about suspicious versions.
However, you can't rely solely on platforms — the responsibility for security also lies with the development teams.
The September attack showed that the supply chain is one of the main weaknesses of modern IT. We live in a time when a vulnerability in a small library can paralyze huge projects.
Take care of your projects: update wisely, use 2FA, and remember that trust in open source is no reason to relax.
Article prepared for the platform Code. For more useful materials and discussions, see our Telegram channel