How Supply Chain Attacks Work

Acesse a versão em português aqui: Clique Aqui Hi everyone. Today I want to share a little more knowledge about a type of attack that has become increasingly frequent: the Supply Chain Attack. Let's see how this works in the npm ecosystem and what we can do to mitigate this risk. Remember that I've only used npm as an example here, but this type of attack can occur in other package managers as well! Here you'll find a tool I developed to mitigate this type of attack. Safeinstall If you want to see how the tool works, take a look here SafeInstall Introduction How many times a day do you run npm install ? For most JavaScript and Node.js developers, the answer is: many. This seemingly innocent routine — installing a dependency to solve a problem — hides an attack vector increasingly exploited by cybercriminals: the supply chain attack . In this article, we explore what these attacks are, how they work in practice using a real demonstration project, what the consequences would be in produc