Software Supply Chain Security for npm and PyPI Projects

A typical JavaScript or Python app runs far more third-party code than first-party code. Attackers know this: compromised maintainer accounts, typosquatted packages and poisoned build pipelines have all hit popular ecosystems, including several high-profile npm incidents in 2025.

1. Lock and pin

• Commit lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock, poetry.lock).
• Install exactly what's locked in CI: npm ci, uv sync --frozen.
• Review lockfile changes in pull requests, especially new packages.

2. Be careful what you add

• Check the exact package name (typosquats like reqeusts exist).
• Prefer well-maintained packages with many maintainers and recent releases.
• Small helpers can often be written in a few lines instead of adding a dependency.

3. Limit install-time code

npm config set ignore-scripts true       # don't run postinstall scripts by default
# allow them only for packages that genuinely need a build step

Many malicious packages do their damage in postinstall. Some package managers (for example pnpm) block dependency lifecycle scripts unless you allow them explicitly.

4. Delay brand-new versions

Malicious versions are usually caught within days. Tools like Renovate can wait a few days before proposing an update (a "minimum release age"), which avoids being among the first to install a compromised release.

5. Scan continuously

npm audit --omit=dev
pip-audit

Enable Dependabot or Renovate security updates, and consider tools that flag suspicious behaviour in new packages, not just known CVEs.

6. Prevent dependency confusion

Publish internal packages under a scope you own (@acme/...) and configure your registry so internal names can't be resolved from the public registry.

7. Harden the pipeline

• Least-privilege CI tokens; pin third-party CI actions to commit SHAs.
• Publish packages with provenance (npm publish --provenance) or trusted publishing, and require 2FA for maintainers.
• Generate an SBOM (software bill of materials) for releases so you can answer "are we affected?" quickly.