Post

While the vanity metric is very fun, as 'supply chain attack' news increases, I'm feeling less and less comfortable with the fact that I maintain an npm package with 6M weekly downloads and 2.6k dependents… 😅

Sam Rose

@samwho.dev

12 May

You missed a parcel delivery! It has been returned to the depot and you have until Wednesday midday to enter your NPM account email and password into fedex.rhejdirjehrheijrjjfirjrnrjjrjrnj.xyz or we will incinerate it and throw it at you the next time you leave the house.

Chris Morrell

@cmorrell.com

But the new attacks are like: - they submit a patch to a project that the makers of my robo-vacuum relies on - they hack a chip supplier who sells chips to a computer vision algo vendor - [45 more steps] - somehow my vacuum issues an npm token to itself and syncs to a random dropbox account

12/5/26, 2:59 pm0 reposts7 likes

No replies yet.