Protecting your Supabase projects from npm supply chain attacks

This post outlines defense strategies against NPM supply chain attacks including three attack patterns and practical mitigation steps.

• •Three main attack vectors: maintainer compromise (stolen tokens), typosquatting (similar package names), and build pipeline compromise (poisoned caches)
• •Malicious npm install scripts can extract credentials, AWS metadata, SSH keys, and kubeconfig from affected systems
• •Key defenses: upgrade to pnpm 11+ with 3-7 day minimumReleaseAge, pin exact versions for security dependencies, commit lockfiles
• •Verify package names before installation, pin GitHub Actions to commit SHAs, avoid pull_request_target with code checkout
• •Use security scanners like Socket.dev or Snyk as secondary defense, rotate credentials if any dependency was compromised