The Adversary's Mind Daily Tools Field manuals ↗ Run the AI AuditAI Audit
Topic

Supply chain

2 posts All posts

How-to

Check an npm package before you install it

Installing a package runs its code. So the thirty seconds you spend looking at it beforehand are the only thirty seconds where you're still in control. Here's what I actually check, and the commands for each.

Ritika Sharma 3 min read
Supply chain

Your dependencies run code before your code does

An install is not a download. npm and pip will execute code from a package you have never imported, on a machine that usually holds your cloud credentials — which is why a mistyped package name is a compromise rather than a failed build.

Ritika Sharma 6 min read
← All posts