Supply chain attacks on NPM packages have become increasingly destructive, with popular packages like Axios, Chalk, and TanStack being compromised by worms that steal data and spread through developer workflows. The author shares a practical security checklist derived from a real codebase compromise of the Neutralinojs open source project. Key attack vectors covered include compromised NPM packages, typosquatting, malicious pull requests, overly permissive tokens, clipboard hijacking, phishing, CI/CD pipeline vulnerabilities, and compromised AI coding agents. The checklist addresses securing dependencies, code review practices, permission management, CI/CD pipelines, and developer credentials. An incident response plan is also provided, emphasizing containment, infrastructure hardening, and impact assessment without panicking. The guidance applies beyond JavaScript to Python, Go, Rust, and other ecosystems.
