Supply-chain attacks

#Dependencies as an entry point

A modern app has more code written by other people than code you wrote yourself. When you run npm install, you get not only the packages you asked for, but also the packages they depend on, all the way down. An attacker who gets into any one link of that chain reaches everyone who uses it. There are three main ways in.

There is a real example. In October 2021, malicious code was published in three versions (0.7.29, 0.8.0, 1.0.0) of ua-parser-js, a popular npm package. The fixed versions are 0.7.30, 0.8.1, and 1.0.1 (GitHub Advisory). The people using it had not made a mistake. It could get in through an ordinary update.

#Lab: list the code that runs at install time

RoamSwitch's Check of code that runs at install time lists the lifecycle scripts that packages in node_modules have. It runs nothing.

mkdir -p app/node_modules/demo-helper app/node_modules/plain-lib
echo '{ "name": "demo-helper", "version": "1.0.0", "scripts": { "postinstall": "node setup.js" } }' > app/node_modules/demo-helper/package.json
echo '{ "name": "plain-lib", "version": "2.0.0" }' > app/node_modules/plain-lib/package.json

# The "reviewed" record is saved under ~/.config/roamswitch/. For this lab, use a throwaway home
LAB_HOME=$(mktemp -d)
HOME=$LAB_HOME roamswitch scan-scripts ./app

これは脅威判定ではなく一覧表示です。何も実行しません。⚠️は誤検知を含む軽量ヒューリスティックです。

    demo-helper 1.0.0 [postinstall]
    node setup.js

確認済みの状態がまだありません。今のインストールスクリプトを確認したら、roamswitch scan-scripts --accept を実行してください。次回からは、増えた分だけを知らせます。

HOME=$LAB_HOME roamswitch scan-scripts --accept ./app

# Suppose an update brought in a new package
mkdir -p app/node_modules/new-helper
echo '{ "name": "new-helper", "version": "1.0.0", "scripts": { "install": "node build.js" } }' > app/node_modules/new-helper/package.json
HOME=$LAB_HOME roamswitch scan-scripts ./app

確認済みの状態を記録しました。次回からは、増えた分だけを知らせます。

(…一覧…)

確認済みにした日(2026-11-03)の後で、インストール時に動くコードが増えたパッケージが 1 件あります。

● new-helper  - → 1.0.0  新しいパッケージがインストール時のコードを持っています (install)

#Lab: find look-alike package names

A fake is made to resemble the name of a famous package. It bets on typing mistakes, so it is called typosquatting. Look-alike package detection compares the names in your package.json dependencies with famous names.

cat > app/package.json <<'EOF'
{ "name": "demo-app", "version": "1.0.0",
  "dependencies": { "express": "^4.0.0", "expresss": "^4.0.0", "reakt": "^18.0.0", "lodahs": "^4.17.0" } }
EOF
roamswitch scan-typosquat ./app

これは静的な参考情報であり断定ではありません。ネットワーク接続は一切行いません。正規の類似パッケージが誤検知されることもあります。

⚠️  expresss は次に似ています: "express" (distance 1)  [./app]
⚠️  reakt は次に似ています: "react" (distance 1)  [./app]

Here is what happened when I tried other misspellings on a real machine.

In what I tried, adding or replacing one letter was found, and swapping adjacent letters was not. The result may change with the product version and the list of names it received. "Not found" is not proof of safety.

#Building your defense

RoamSwitch's list and detection are part of the front door. Combine them with measures like these.

• Control the install: use npm ci to install exactly what the lockfile says, and add --ignore-scripts when you do not want scripts to run. Allow scripts only for the packages that need them
• Do not use a new version right away: avoid a version just after publication, and wait a few days. A hijacked version is most dangerous in the time before it is noticed and withdrawn
• Confine the scripts: according to its command description, RoamSwitch's roamswitch install wraps install of npm or pnpm, and confines script execution inside an isolated environment (this lesson did not run it to check)
• Watch what increased: at every update, check whether packages with scripts have increased

#What it cannot see

#What to learn next

• Known vulnerabilities in dependencies, including the case where no fix exists, are covered in the crisis response playbook for server operators
• To prepare for secrets stolen through a dependency, Credential theft and leaked secrets will help