> Markdown version of [/videos/245-oops-stories-of-supply-chain-shenanigans](https://www.wearedevelopers.com/videos/245-oops-stories-of-supply-chain-shenanigans). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Oops! Stories of supply chain shenanigans Could an obscure NPM dependency be silently stealing credentials during your build phase? Discover how to neutralize rogue lifecycle scripts and secure your JavaScript supply chain. - **Speakers:** Zbyszek Tenerowicz - **Event:** WeAreDevelopers LIVE - **Published:** September 15, 2021 - **Duration:** 43:57 - **URL:** https://www.wearedevelopers.com/videos/245-oops-stories-of-supply-chain-shenanigans ## Summary Supply chain security in JavaScript applications requires rigorously managing the vast ecosystem of NPM modules, where risks range from unpatched vulnerabilities to intentionally malicious packages. While built-in tools like `npm audit` can surface dangerous flaws like prototype pollution or regex denial of service, they often trigger noisy alerts for non-exploitable bugs. This leads to alert fatigue and frequently broken CI pipelines. To regain control over dependency audits, teams can leverage tools like `npm-audit-resolver` to specifically triage, ignore, or postpone vulnerabilities without broadly degrading CI automation. However, tracking known vulnerabilities is only half the battle. Malicious packages securely nested deep inside dependency trees can silently execute payloads—such as credential theft or backend code injection—without the package ever being explicitly invoked by the host application. These payloads are typically deployed through NPM lifecycle hooks like `postinstall` scripts during the build phase. Securing your build pipeline requires an aggressive containment strategy that blocks these implicit executions. Best practices dictate isolating the installation process by spawning a disposable container, executing `npm ci --ignore-scripts` to neutralize unauthorized lifecycle hooks, and subsequently whitelisting essential scripts using tools like `allow-scripts` (from LavaMoat) or `can-i-ignore-scripts`. Combined with strict dependency lockfile management and frequent module updates, this workflow successfully neutralizes third-party execution risks while maintaining reliable deployment cycles. **Keywords:** supply chain security, npm module dependencies, node.js vulnerability management, prototype pollution, npm audit resolution, regex denial of service, malicious package detection, npm lifecycle scripts, postinstall script exploits, ci/cd pipeline security, containerized build environments, dependency lockfiles, ignoring npm scripts, lavamoat allow-scripts, cross-site scripting mitigation ## Chapters 1. **Introduction to supply chain security principles** (00:00) — An introduction to the foundational concepts of securing modern application supply chains. 1. **Understanding modern software supply chains in web development** (01:37) — Modern applications natively rely on numerous external NPM packages created by third parties. 1. **Challenges with automating vulnerability audits in development pipelines** (03:21) — Strictly blocking builds on new package vulnerabilities causes unnecessary friction and alert fatigue during continuous integration. 1. **Managing security alerts with NPM audit resolver** (07:40) — Wrapping standard audit tools allows developers to intentionally ignore, postpone, or address security alerts without breaking CI pipelines. 1. **How malicious packages exploit installation lifecycle scripts** (11:42) — Attackers can define malicious postinstall scripts within dependencies to execute arbitrary code during the installation phase. 1. **Demonstration of malicious compiler output modification** (17:40) — A postinstall script can subtly alter local tooling like the TypeScript compiler to inject environment variable exfiltration capabilities into applications. 1. **Defending against malicious package scripts during installation** (21:28) — Passing the ignore scripts flag blocks unauthorized execution while companion tooling selectively re-enables necessary legitimate scripts. 1. **Identifying safe exceptions for dependency lifecycle scripts** (24:26) — Dedicated command-line tools can analyze node modules to verify which packages genuinely require their lifecycle scripts to function properly. 1. **Recommended workflow for continuous integration dependency installation** (27:47) — A secure pipeline strategy combines disposable containers, version lock files, and selective script allowances to install application dependencies. 1. **Audience questions on tool configurations and package locks** (28:59) — A closing discussion covers the purpose of lock files, defenses like content security policies, and maintenance intervals for dependency updates. ## Related Moments - [Supply chain security risks in NPM dependency code](https://www.wearedevelopers.com/videos/1028-cross-site-scripting-is-yesterday-s-news-isn-t-it) (from "Cross Site Scripting is yesterday's news, isn't it?") - [Dependency risks in widespread NPM supply chain attacks](https://www.wearedevelopers.com/videos/1719-wearedevelopers-live-fun-and-games-and-all-that-comes-with-it-back-to-basic-more) (from "WeAreDevelopers LIVE - "Fun and games - and all that comes with it", Back to BASIC & more") - [Highlighting supply chain vulnerabilities from obfuscated package manager backdoors](https://www.wearedevelopers.com/videos/1284-dev-digest-end-of-year-recap) (from "Dev Digest End of Year Recap") - [Mitigating dependency confusion in NPM packages](https://www.wearedevelopers.com/videos/724-security-in-modern-web-applications-owasp-to-the-rescue) (from "Security in modern Web Applications - OWASP to the rescue!") - [Avoiding supply chain risks within standard software dependencies](https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski) (from "How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski") - [Mitigating supply chain attacks via automated post-install hooks](https://www.wearedevelopers.com/videos/1822-wearedevelopers-live-11ty-and-a11y) (from "WeAreDevelopers LIVE - 11ty and a11y") ## Related Articles - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms](https://www.wearedevelopers.com/magazine/635-dev-digest-188-cfp-time-the-risks-of-npm-and-ikea-algorithms) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) ## Related Jobs - [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio** - [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub** - [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub** - [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group** - [Staff Engineer - Offensive Security](https://www.wearedevelopers.com/jobs/ext/1226927-staff-engineer-offensive-security) at **Twilio** - [Endpoint Security Engineer](https://www.wearedevelopers.com/jobs/ext/1962698-endpoint-security-engineer) at **ZEISS Group**