NPM supply-chain attacks in 2025–2026: what changed and our checklist

Supply-chain incidents in the npm registry kept security teams busy through 2025 and into 2026. Attackers did not need to break your servers first — they shipped malware inside dependencies that looked like everyday utilities: fake ESLint plugins, hijacked packages with millions of weekly downloads, and postinstall scripts that exfiltrated environment variables from CI and developer laptops.

The pattern is familiar: a maintainer phished, a token leaked, or a name squatting on a popular package fooled rushed `npm install` runs. For a studio like ADSA Labs — Next.js, React, Supabase, Vercel — the blast radius is every repo that auto-updates without lockfile discipline or integrity review.

We treat dependency installs like production deploys: lockfiles committed, `npm audit` and OSV feeds in CI, and delayed auto-merge on Dependabot until a human skims release notes for packages with install scripts. In client projects we prefer fewer dependencies over the shiniest helper library.

Secrets never belong in `.env` files that a random package can read during postinstall. On Vercel and local dev we use platform secret stores, rotate keys after any teammate laptop compromise, and scope Supabase service role keys to backend-only routes — never to browser bundles.