Why npm dependencies are a bigger security risk than your code

Modern JavaScript apps depend on hundreds or thousands of npm packages, many of which can execute code during installation and access CI secrets, cloud credentials, and build artifacts. Supply chain attacks exploit this trust by compromising packages, maintainer accounts, or release pipelines rather than the application itself. Recent real-world incidents — including the compromise of packages like debug and chalk, the Shai-Hulud npm worm, and the TanStack attack affecting OpenAI devices — illustrate how transitive dependencies dramatically expand the blast radius. Key defenses include committing lockfiles and using npm ci for reproducible installs, running npm install --ignore-scripts to block install-time code execution, routing installs through a private registry proxy, scoping CI secrets tightly, and using scanners like Snyk, Socket, and OSV-Scanner as a baseline. A practical checklist covers evaluating package need, maintenance status, ownership changes, install scripts, transitive dependency size, and CI permissions before adding or updating any dependency.