Compromised packages, poisoned updates: what your dependencies let into your app.
On August 4, a self-propagating worm infected more than 400 npm packages downloaded around 2 billion times a month, through their maintainer's own CI pipeline. The signatures were valid. That's exactly the problem.
On March 31, two poisoned versions of axios (100 million weekly downloads) stayed live for about three hours. The malicious dependency had been staged the day before so it wouldn't look brand new.
