Why npm dependencies are a bigger security risk than your code

Supply chain attacks target the packages and pipelines your app already trusts, not your code directly. With hundreds of transitive dependencies in a typical JavaScript project, a single compromised utility can run malicious code during npm install, stealing CI secrets and credentials. Practical defenses include committing lockfiles, disabling install scripts, scoping CI permissions, and routing installs through a private registry.