Lesson 4 of 10 · 13 min read

Package Ecosystem Attacks: npm, PyPI and Beyond

Installing a package means trusting its maintainers, their accounts, their build pipeline and the registry. Attackers abuse each link: look-alike names, private names shadowed by public ones, phished maintainers, poisoned CI that publishes with valid provenance, and worms that steal tokens and republish. Most modern payloads target CI secrets. Effective controls are layered: one index or scoped registries, lockfiles with hashes, blocked install scripts, release cooldowns, behavioural malware detection and CI jobs that never hold secrets while installing.