How the npm supply chain attacks affect devs | Feross Aboukhadijeh | PodRocket

Описание: Feross Aboukhadijeh joins us to break down the recent wave of NPM supply chain attacks hitting the JavaScript ecosystem, including how attackers used phishing to target developers, snuck malware into popular packages like Prettier and "is", and even abused tools like Claude, Gemini, and TruffleHog.
We dig into how GitHub Actions vulnerabilities were exploited, what makes postinstall scripts risky, and how projects like Socket are working to detect threats using AI.

---
Links
Website: https://feross.org
X: https://x.com/feross
GitHub: https://github.com/feross
LinkedIn:   / feross  
YouTube:    / @ferossity  

Related resources
npm Author Qix Compromised via Phishing Email in Major Supply Chain Attack: https://socket.dev/blog/npm-author-qi...
Compromised files replace npm packages with a combined 2 billion weekly downloads: https://www.techradar.com/pro/securit...
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware: https://www.wiz.io/blog/shai-hulud-np...

---
Chapters
00:00:00 npm supply chain attacks explained
00:02:04 npm phishing campaign: Fake login pages
00:02:14 The “is” package malware incident
00:03:05 Prettier ecosystem compromised
00:05:47 NX package breach (August 27 attack)
00:06:26 AI-powered supply chain exploit
00:07:52 GitHub Actions misconfiguration
00:20:09 How malicious packages get published
00:30:02 Why install scripts are so risky
00:30:16 Limitations of banning install scripts
00:40:11 Smarter approaches to dependency updates

---
🎙 Listen to PodRocket
🎧 Spotify: https://open.spotify.com/show/6oFuKu8...
🎧 Apple Podcasts: https://podcasts.apple.com/us/podcast...

📺 Subscribe on YouTube: @LogRocket

Follow on Socials
➡️ Noel Minchow, Host:   / noel-minchow  
➡️ Emily Kochanek, Producer:   / emily-kochanek-11582750  
➡️ Elizabeth Becz, Producer:   / elizabethb3cz  
➡️ LogRocket:   / logrocket  

---
What does LogRocket do?
LogRocket provides AI-first session replay and analytics that surface the UX and technical issues impacting user experiences. Start understanding where your users are struggling by trying it for free at LogRocket.com.