When the ua-parser-js maintainer's npm token was stolen in October 2021, the poisoned release sat live for about four hours. npm audit reported zero vulnerabilities during those four hours, for a package with 7 million weekly downloads. If your incident plan starts with "run the scanner," you don't have an incident plan.
Here's the hour after the alert fires: three questions, fixed order. Everything else waits.
Before you touch a terminal, write at the top of a shared doc the exact package names and version ranges, plus the exposure window with timestamps. Headlines blur scope. When two malicious packages impersonating Axios were caught, Axios itself was never backdoored, and teams that spent their first hour auditing a clean HTTP client wasted it. You can't triage "the npm thing." You can triage a list.
Q1: Is a bad version in any lockfile, present or past? (minutes 10 to 25)
Your package.json is lying to you. A semver range says what could install; the lockfile is the only record of what did install on a given Tuesday. Poisoned releases usually look like a routine patch bump, so start from the lockfile in every repo.
