Supply Chain

New Malicious npm Package Highlights the Speed at Which Supply Chain Risks Propagate

The threat is unique because it does not require a developer to actually run any code to become a victim. The moment a user types the command to install the package, a hidden “preinstall script” executes automatically in the background.