Hacker GitHub

← All repos

bodadotsh/npm-security-best-practices

View on GitHub ↗ ★ 859 PowerShell

[Updated for AI 🤖] Continuous updates on how to stay safe from NPM supply chain attacks

8 mentions on Hacker News by 2 people: 1 story, 7 comments · first 2025-09-21 · latest 2026-06-01

Mentions per year 8 mentions · busiest year 2025 (5)
20082026
AllStoriesComments NewestTopOldest
  1. GitHub repo (800+ stars) on a list of tips for protecting against npm supply chain attacks: https://github.com/bodadotsh/npm-security-best-practices
    comment by bodash · 2026-06-01 · in Malicious npm packages detected across Red Hat Cloud Services
  2. few more tips here: https://github.com/bodadotsh/npm-security-best-practices
    comment by bodash · 2026-05-20 · in GitHub is investigating unauthorized access to their internal repositories
  3. Some great tips in this thread and I've been collecting them all at https://github.com/bodadotsh/npm-security-best-practices
    comment by bodash · 2026-03-31 · in Axios compromised on NPM – Malicious versions drop remote access trojan
  4. …to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://github.com/bodadotsh/npm-security-best-practices Discussion on HN last time: https://news.ycombinator.com/item?id=45326754
    comment by bodash · 2025-11-24 · in Shai-Hulud Returns: Over 300 NPM Packages Infected
  5. …- https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api source: https://github.com/bodadotsh/npm-security-best-practices?tab...
    comment by tmvnty · 2025-11-24 · in Shai-Hulud Returns: Over 300 NPM Packages Infected
  6. Other than general security practices, here are few NPM ecosystem specific ones: https://github.com/bodadotsh/npm-security-best-practices
    comment by tmvnty · 2025-11-24 · in Shai-Hulud Returns: Over 300 NPM Packages Infected
  7. shamless plug but here's a list of things you could follow to mitigate risks from npm: https://github.com/bodadotsh/npm-security-best-practices
    comment by bodash · 2025-10-31 · in NPM flooded with malicious packages downloaded more than 86k times
  8. ▲ 96
    Show HN: Tips to stay safe from NPM supply chain attacks
    story by bodash · 2025-09-21 · 55 comments