npm install Exposes Developers to Supply Chain Attacks

The npm ecosystem faces escalating supply chain attacks, with incidents like the Axios compromise in March 2026 affecting 174,000 downstream packages. The Shai-Hulud campaign infected 796 packages with 132 million monthly downloads, while the Miasma attack used a novel technique to bypass --ignore-scripts. These attacks exploit the trust inherent in npm's dependency tree, where the average project has 79 transitive dependencies with automatic script execution.