Supply-chain security guides for developers
Written from what we see building the incident database - the patterns that recur, the defences that work, and the widely-repeated advice that does not.
Does npm audit detect malicious packages?
npm audit finds known vulnerabilities in legitimate packages. It is much weaker at finding deliberately malicious ones, and this explains why - plus what to run instead.
You installed a malicious package. What now?
A practical incident-response order of operations for developers who have just found a compromised package in their dependency tree - what to rotate, in what order, and what not to bother with.
How to tell if an npm package is malicious
Practical signals for judging whether an npm package is safe to install - what actually predicts trouble, what looks alarming but does not, and how to check before you install.
Lockfile security: what actually helps
Why committing a lockfile matters for supply-chain security, how npm ci differs from npm install, and the lockfile habits that reduce real exposure.
The main types of dependency supply-chain attack
Typosquatting, dependency confusion, maintainer account takeover, and self-propagating worms - how each one reaches you and which defences actually apply to which.
Would rather just check? Paste a lockfile and see whether any of this applies to you.