Your dependencies are code you didn’t review
One phished maintainer can push malware into thousands of apps. Simple habits that limit the damage.
A typical web app pulls in hundreds of packages. Each one is code that runs with your app’s permissions, written by people you’ve never met.
This September showed how fragile that is. An npm maintainer was phished, and malware went into some of the most downloaded JavaScript packages for a few hours. Anyone who installed fresh in that window got it.
Habits that help:
- Commit the lock file and install with
npm ci(or your ecosystem’s equivalent) in CI, so builds use exact versions. - Don’t update the second a release appears. A few days’ delay lets others find the bad ones.
- Turn on dependency alerts (Dependabot or similar) and actually read them.
- Fewer packages. Ten lines you write beat a package with forty dependencies.
- Build servers get no production secrets they don’t need. Install scripts run there too.
You can’t review every line. You can control when new code comes in and how much it can reach.