DOP 366: How to Prevent npm Supply Chain Attacks

Episode 366

Show Notes

#366: You ran npm install this morning. Maybe you ran it a dozen times. Every one of those pulled down a dependency tree you have never read, from a registry that spent years in maintenance mode, and then executed whatever preinstall and postinstall scripts happened to be in there. On your laptop. With your keys sitting on disk.

Trusted publishing, provenance, staged releases - all good, all recent, and none of it stops a package from shipping malware.

In this episode, we speak with David Mytton, CEO of Arcjet, about defense in depth for the npm ecosystem, and why seven days of patience beats most of your tooling.

Frequently Asked Questions

Why is running npm install a security risk?

Running npm install executes arbitrary code on your machine before and after a package is put in place. David Mytton of Arcjet explains on DevOps Paradox episode 366 that npm supports pre-install and post-install hooks, so a package author can run whatever they like on a developer laptop, in a CI pipeline, or in production. He describes the hooks as a convenience from an era when the registry was treated as a trusted community resource. Configuration options exist to disable them, but they are not the default.

How long should an npm dependency cooldown period be?

Seven days is the cooldown David Mytton uses at Arcjet, he says on DevOps Paradox episode 366. Most of the recent npm compromises were live for only a couple of hours before being caught, so a seven-day wait catches the majority of them while keeping you current enough that a genuine security update is not badly delayed. Arcjet enforces it through Renovate, which lists the dependencies still inside the window separately and allows a deliberate bypass when an urgent fix lands.

What is the difference between npm install and npm ci?

npm ci installs from an existing lock file, so the same versions are installed every time, while npm install resolves versions afresh. David Mytton explains on DevOps Paradox episode 366 that npm install also adds a new package with a version range rather than a pinned version by default, which is how a compromised release deeper in the dependency tree gets pulled in automatically. He sets npm configuration to pin dependencies on all of his own projects.

Does npm trusted publishing stop supply chain attacks?

Trusted publishing closes one attack path and leaves the larger one open, David Mytton argues on DevOps Paradox episode 366. It replaces long-lived publishing tokens with short-lived OIDC credentials issued to a build workflow and ties a released package back to the provenance of its build, and npm’s newer staged releases can require a second person to approve a publish. None of that inspects what is inside the package, so a release containing malware remains an entirely separate problem.

How do you isolate a development environment from compromised npm packages?

Run dependency installs inside a container or a virtual machine so that nothing reaches the host. David Mytton says on DevOps Paradox episode 366 that Arcjet used dev containers and then moved to lightweight virtual machines on macOS, because the team runs several work trees in parallel for AI agents and a VM offers a stronger isolation guarantee. Malware in the dependency tree then has no access to keys on disk, password manager contents, or browser cookies, and the environment can simply be deleted.

How would you know if a compromised npm package ran on your laptop?

Usually you would not, David Mytton acknowledges on DevOps Paradox episode 366, because a post-install script can exfiltrate credentials and then delete itself. Arcjet runs endpoint management and scanning tools that watch for known indicators of compromise, and Mytton suggests a canary token left on disk that raises an alert if anything reads it. Without something along those lines, the first sign is often someone reaching your production environment or your sessions being logged out.

What is the DevOps Paradox podcast?

DevOps Paradox is a weekly podcast co-hosted by Darin Pope and Viktor Farcic, covering DevOps, platform engineering, and modern software delivery. Episode 366 features David Mytton of Arcjet on npm supply chain attacks: why install hooks hand packages arbitrary code execution, what trusted publishing and staged releases do and do not fix, and why a seven-day dependency cooldown catches most compromises. Every episode page carries audio, video, and a full transcript.

Episode Transcript

Read the Full Transcript

Share and Download

Guests

David Mytton

David Mytton

David Mytton is the Founder & CEO of Arcjet, a runtime security platform that provides developer building blocks to protect applications from bots & automation, prompt injection, AI tool abuse, and signup spam. He also writes the devtools newsletter console.dev.

Hosts

Darin Pope

Darin Pope

Viktor Farcic

Viktor Farcic

Viktor Farcic is a member of the Google Developer Experts and Docker Captains groups, and published author.

His big passions are DevOps, Containers, Kubernetes, Microservices, Continuous Integration, Delivery and Deployment (CI/CD) and Test-Driven Development (TDD).

He often speaks at community gatherings and conferences.

He has published DevOps Paradox and Test-Driven Java Development.

His random thoughts and tutorials can be found in his blog The DevOps Toolkit.