Every npm supply chain postmortem ends with the same advice: verify the package before you install...
Every npm supply chain postmortem ends with the same advice: verify the package before you install it.
So I looked at what the tools that do this actually check. Most of them check whether the package exists.
That check is dead. Here are three package names documented as AI hallucinations, against the npm registry right now:
react-codeshift HTTP 200
react-fetch-hook HTTP 200
Originally posted on getcommit.dev. In October 2021, ua-parser-js was used by Facebook, Microsoft,...
Half your code is now written by an AI that hallucinates the other half's package names. That's not...
Since npm v12 shipped on July 8, dependency lifecycle scripts (preinstall, install, postinstall) and...
The concrete problem A package is reported compromised. Your security channel immediately...
A few weeks back I inherited an old Node.js project and spent half a day grepping package.json trying...
Reconciling the mantine-datatable supply chain breach. Why we avoided UI library bloat to build a safe, zero-dependency Next.js…
