Category Archives: cybersecurity

🚨 Supply Chain Attacks: The Hidden Risk in Your Dependencies

Leave a reply

Recently, a widely used library — Axios — was compromised.

For a short window, running npm install could pull malicious code designed to steal credentials. Incidents like this have even been linked to state-sponsored groups, including North Korea.

That’s a supply chain attack.

Related YT video:

🧠 What is a Supply Chain Attack?

A supply chain attack is when attackers don’t hack you directly…

They compromise something you trust.

  • A dependency
  • A library
  • A tool in your pipeline

Instead of breaking your code, they poison your dependencies.

And because modern apps rely on hundreds of packages…
this scales extremely well.

🔥 Why This Works

We trust dependencies too much.

  • We install updates blindly
  • We use “latest” versions
  • We assume registries are safe

But in reality:

Installing a dependency = executing someone else’s code

🛡️ How to Protect Yourself

Let’s go straight to what actually works.

📌 1. Version Pinning

Don’t use floating versions.

Bad:

pip install requests
npm install lodash

Good:

requests==2.31.0
lodash@4.17.21

This ensures you always install the exact same version.

🔒 2. Lockfiles + Hash Pinning

A lockfile records the exact versions of all your dependencies — including indirect ones.

Examples:

  • package-lock.json
  • poetry.lock
  • uv.lock

Think of it as a snapshot of your dependency tree.

Instead of:

“install lodash”

You’re saying:

“install this exact version, plus all its exact dependencies”

🔐 Hash Pinning

Some lockfiles also include cryptographic hashes.

This means:

  • The version must match ✅
  • The actual file must match ✅

If something is tampered with → install fails.

Lockfiles = reproducibility
Hashes = integrity

⏳ 3. Avoid Fresh Versions

A simple but powerful rule:

👉 Don’t install newly published versions immediately

Why?

  • Malicious releases are often caught quickly
  • Early adopters take the risk

Waiting even a few days can make a big difference.

🔍 4. Continuous Scanning with SonarQube

Use tools like SonarQube to analyze your codebase.

They help detect:

  • Vulnerable dependencies
  • Security issues
  • Risky patterns

But remember: they won’t catch everything.

🧱 5. Reduce Dependencies

The fewer dependencies you have…

…the fewer things can betray you.

🧠 Mental Model

Dependencies are not just libraries.

They are:

Remote code execution with a nice API

🚀 Final Thoughts

Supply chain attacks are growing because they scale:

  • Attack one package
  • Impact thousands of developers

To reduce your risk:

  • Pin versions
  • Use lockfiles + hashes
  • Don’t blindly trust “latest”
  • Be cautious with fresh releases

🔗 References