Security · 1h ago
Two-Line Supply Chain Attack Targets npm via Rogue Registry
A pull request to the etherscan-api npm package added a .npmrc file redirecting package resolution to an attacker-controlled HTTP server. The social engineering used a believable profile and a plausible refactor description. The attack could compromise all dependencies during install, not just the new package.
Meridian48 take
The attack's simplicity—two lines in .npmrc—underscores how easily supply chain attacks can bypass human review, even in well-maintained projects.
Read the full reporting
A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack →
DEV Community
supply-chain-attacknpm-security