146
supply-chain attack
The code you did not write runs with your privileges. Pin it. Review the install script.
What is supply-chain attack?
A supply-chain attack arrives through a dependency, a build plugin, or a compromised maintainer. Lockfiles pin versions. Install scripts run arbitrary code. A new package named almost like a popular one is a typo-squat.
Why does supply-chain attack matter when vibe coding?
Models `npm install` whatever the answer suggested, including packages that do not exist — then you create the typo on the public registry by accident, or you install a hallucination. Name the lockfile and “do not add a dependency for one line.”
How do you do supply-chain attack?
Commit the lockfile. Do not run install scripts you have not looked at. Prefer the standard library for trivial helpers. Check that a new package exists and is the one you meant.
How do you ask a model for supply-chain attack?
Do not add a dependency unless (task) cannot be done in a few lines. Use the existing lockfile. Do not invent package names. Do not suggest a postinstall script. If you add a package, pin it via the lockfile.
What goes wrong with supply-chain attack?
Pinning versions in package.json and floating them in the lockfile, or the reverse, and calling it pinned. The lockfile is what the install uses. Commit it.