Over the past two months, we’ve seen some of the most serious supply chain attacks in npm history: phishing campaigns, maintainer account takeovers, and malware published to packages with billions of weekly downloads. What is going on?! What can we do about it? Our old friend, Feross Aboukhadijeh, joins us to help make sense of it all.
<a href="https://changelog.zulipchat.com/#narrow/stream/455613-friends">Join the discussion</a><a href="https://changelog.com/++" rel="payment">Changelog++</a> members save 2 minutes on this episode because they made the ads disappear. Join today!Sponsors:<ul><li><a href="https://depot.dev">Depot</a> – 10x faster builds? Yes please. Build faster. Waste less time. Accelerate Docker image builds, and GitHub Actions workflows. Easily integrate with your existing CI provider and dev workflows to save hours of build time.
</li>
</ul>Featuring:<ul><li>Feross Aboukhadijeh &ndash; <a href="https://feross.org/" rel="external ugc">Website</a>, <a href="https://github.com/feross" rel="external ugc">GitHub</a>, <a href="https://x.com/feross" rel="external ugc">X</a></li><li>Jerod Santo &ndash; <a href="https://github.com/jerodsanto" rel="external ugc">GitHub</a>, <a href="https://www.linkedin.com/in/jerodsanto" rel="external ugc">LinkedIn</a>, <a href="https://changelog.social/@jerod" rel="external ugc">Mastodon</a>, <a href="https://x.com/jerodsanto" rel="external ugc">X</a></li><li>Adam Stacoviak &ndash; <a href="https://adamstacoviak.com/" rel="external ugc">Website</a>, <a href="https://github.com/adamstac" rel="external ugc">GitHub</a>, <a href="https://www.linkedin.com/in/adamstacoviak" rel="external ugc">LinkedIn</a>, <a href="https://changelog.social/@adam" rel="external ugc">Mastodon</a>, <a href="https://x.com/adamstac" rel="external ugc">X</a></li></ul>Show Notes:<ul>
<li><a href="https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise">Active supply chain attack: npm phishing campaign</a></li>
<li><a href="https://socket.dev/blog/npm-phishing-email-targets-developers-with-typosquatted-domain">Npm phishing email targets developers with typosquat</a></li>
<li><a href="https://socket.dev/blog/nx-packages-compromised">Nx npm packages compromised in supply chain attack</a></li>
<li><a href="https://socket.dev/blog/introducing-socket-firewall">Introducing socket firewall</a></li>
<li><a href="https://forms.gle/yCJirHRCWkdbG5qK6">Changelog News Classifieds</a></li>
</ul>
Something missing or broken? <a href="https://github.com/thechangelog/show-notes/blob/master/friends/changelog--friends-111.md">PRs welcome!</a>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

npm under siege (what to do about it) (Friends)

The Changelog: Software Development, Open Source (via Backfeed)

AI Chapters

AI Insights

Reviews