In this Modern Web Podcast, Rob Ocel and Danny Thompson break down the recent string of NPM supply chain attacks that have shaken the JavaScript ecosystem. They cover the NX compromise, the phishing campaign that hit libraries like Chalk, and the Shy Halood exploit, showing how small changes in dependencies can have massive effects. Along the way, they share practical defenses like using package lock and npm ci, avoiding phishing links, reviewing third party code, applying least privilege, staging deployments, and maintaining incident response plans. They also highlight vendor interventions such as Vercel blocking malicious deployments and stress why companies must support open source maintainers if the ecosystem is to remain secure.Key Points from this Episode:- Lock down installs. Pin versions, commit package-lock.json, use npm ci in CI, and disable scripts in CI (npm config set ignore-scripts true) to neutralize post-install attacks.- Harden people & permissions. Phishing hygiene (never click-through emails), 2FA/hardware keys, least-privilege by default, and separate/purpose-scoped publishing accounts.- Stage & detect early. Canary/staged deploys, feature flags, and tight observability to catch dependency drift, suspicious network egress, or monkey-patched APIs fast.- Practice incident response. Two-hour containment target: revoke/rotate tokens, reimage affected machines, roll back artifacts, notify vendors, and run a post-mortem playbook.Rob Ocel on Linkedin: <a href="https://www.linkedin.com/in/robocel/" target="_blank" rel="noopener noreferer">https://www.linkedin.com/in/robocel/</a>Danny Thompson on Linkedin: <a href="https://www.linkedin.com/in/dthompsondev/" target="_blank" rel="noopener noreferer">https://www.linkedin.com/in/dthompsondev/</a>This Dot Labs Twitter: <a href="https://x.com/ThisDotLabs" target="_blank" rel="noopener noreferer">https://x.com/ThisDotLabs</a>This Dot Media Twitter: <a href="https://x.com/ThisDotMedia" target="_blank" rel="noopener noreferer">https://x.com/ThisDotMedia</a>This Dot Labs Instagram: <a href="https://www.instagram.com/thisdotlabs/" target="_blank" rel="noopener noreferer">https://www.instagram.com/thisdotlabs/</a>This Dot Labs Facebook: <a href="https://www.facebook.com/thisdot/" target="_blank" rel="noopener noreferer">https://www.facebook.com/thisdot/</a>This Dot Labs Bluesky: <a href="https://bsky.app/profile/thisdotlabs.bsky.social" target="_blank" rel="noopener noreferer">https://bsky.app/profile/thisdotlabs.bsky.social</a>Sponsored by This Dot Labs: <a href="https://ai.thisdot.co/" target="_blank" rel="noopener noreferer">https://ai.thisdot.co/</a>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

How NPM Auto-Updates & Post-Install Scripts Could Hijack Your Org

Modern Web

AI Chapters

AI Insights

Reviews