NPM Security

Using npm install in production can lead to inconsistent installations when lockfiles and package.json files are out of sync, potentially introducing unintended package versions and security vulnerabilities that are resolved during install-time. These configurations prevent package managers from installing any package version that was published less than the specified time period ago. Configure npm, pnpm, Bun, or Yarn to delay package installations by setting a minimum release age in your package manager’s configuration file. The fetched repository can ship its own .npmrc that re-enables lifecycle scripts — silently undoing –ignore-scripts — and the code is never scanned by registry-side malware checks. Pnpm allows an “escape hatch” to re-enable postinstall scripts or set an explicit allow-list of packages that are allowed to run postinstall scripts.

The fake login page captured credentials and 2FA tokens through adversary-in-the-middle techniques. 80% of application dependencies remain un-upgraded for over a year, even when 95% of vulnerable components have fixed versions available (Sonatype, 2024). Several critical vulnerabilities in 2024 took over 500 days to fix (Sonatype, 2024). Packages that have not been updated in over 1,000 days are effectively unmaintained. The vulnerability might be https://www.inrecognition.org/what-are-the-trends-in-workplace-learning-and-development/ three or four levels deep in your dependency tree, invisible unless you specifically analyse the complete SBOM.

Shadowserver reports https://power-at-work.com/the-future-of-earthmoving-machinery-trends-and-predictions/ 90,300 instances still vulnerable. Npm audit checks against a single vulnerability database and only catches known, reported CVEs. This guide covers npm security comprehensively. Snyk’s research found 52% of teams often fail to meet vulnerability SLA deadlines, with 74% setting unrealistic SLAs of a week or less (Snyk, 2024).

• Useful for the CVE class; misses supply chain attacks for the structural reasons above.
• Attackers exploit the widespread practice of reusing packages by injecting malware into lesser-maintained dependencies that are still actively used across thousands of applications.
• The list below highlights packages that consistently appear in vulnerability reports, supply chain incidents, and real-world exploitation.
• The Indonesian Foods campaign generated a new malicious package every seven seconds, creating 100,000+ packages in days (Sonatype, 2026).
• Your goal is to upgrade with review and signals, not “everything to the latest”.

Reviewing and acting on the security audit report

• Bun disables postinstall scripts by default and maintains its own internal allow-list of packages that are allowed to run postinstall scripts.
• A state-sponsored actor compromised a package present in 80% of cloud environments through two weeks of social engineering against a single maintainer account.
• In automated environments such as continuous integration and deployments, we should install the exact dependencies as defined in the lockfile.
• Between the variety of Node.js package managers and different versions of Node.js you may have installed in your path, how do you verify a healthy npm installation and working environment?
• But treating npm install as a safe operation without guardrails is no longer defensible.

Updated for AI 🤖 Continuous updates on how to stay safe from NPM supply chain attacks Here’s their talk on AI powered malware hunting at scale, Jan 2025. Socket.dev is a security platform that protects code from both vulnerable and malicious dependencies. SCA (Software Composition Analysis) tools scans the actual filesystem and finds standalone JS files, vendor scripts, and client-side assets regardless of whether they exist in a package manifest.

Turning off npm audit on package installation

• This guide shares some npm security best practices that we first published in 2019, and further strengthens and extends them to incorporate modern practices and lessons learned from the supply chain attacks we’ve witnessed in 2025.
• When you run npm install, npm may resolve the public malicious package instead of your internal one because of the higher version.
• Malicious packages can execute arbitrary code during installation, exfiltrate sensitive data, or introduce vulnerabilities into your system without your knowledge.
• Updated for AI 🤖 Continuous updates on how to stay safe from NPM supply chain attacks
• Many popular npm packages have been found to be vulnerable and may carry a significant risk without proper security auditing of your project’s dependencies.
• For current vulnerable packages and CVE-specific guidance, see the npm security vulnerabilities reference.

By implementing a “cooldown” period before installing or upgrading to new package versions, you reduce the risk of installing compromised packages that may be quickly discovered and removed from the registry. Newly released packages and versions may contain malicious code that are often-times quickly picked up by the community in matter of hours or days and subsequently unpublished. However, pnpm 10.26+ provides blockExoticSubdeps to prevent transitive dependencies from pulling code from git repositories or raw tarball URLs — sources that bypass registry security scanning. Pnpm does not have a direct equivalent to npm’s allow-git setting that blocks all git dependencies outright. Even with post-install scripts disabled, git-sourced dependencies can introduce unreviewed, unversioned code into your project.

Avoid publishing secrets to the npm registry¶

The difference is that deps.dev offers a broader package intelligence report, such as metadata, licenses, and health signals etc. Here, I am following the best practice suggested by the node.js security best practices17. Pnpm also allows Git Branch Lockfiles where it creates a new lockfile based on branch name, and automatically merge it back into the main lockfile later. Modern package managers have built-in conflict resolutions1516, just checkout main and re-run install.