NPM
npm’s attempts to make package publishing safer haven’t stemmed the relentless supply chain attacks: Are they on the right track?
“This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package."
“You now have this ongoing security incident and nobody of any particular clear authority being able to take control of it. That's a lot of chaos”
The malicious code creates a 'cascading compromise effect' into dependent ecosystems across npm's registry.
Protect yourself from malicious "phish" swimming upstream in OSS package consumption.
"No-one has the time or sanity to audit every thing every build process pulls in."