How the attacks work

A malicious version is published — through a hijacked maintainer account, a typosquatted package name, or a compromised build pipeline — and is pulled in automatically on the next install.

Defences that are actually practical

Realistic for small teams:

  • Commit your lock file
  • Pin versions rather than tracking latest
  • Review dependency updates like code
  • Reduce the number of dependencies you carry

The uncomfortable truth

Most projects cannot audit their transitive dependencies. Reducing how many you have is the most reliable available mitigation.