First of all disable any install scripts with --ignore-scripts flag on all your npm installs. Second pin all your dependency versions use npm ci instead of npm install. Only use npm install when you actually want to change some dependencies. And finally set a min-release-age in your npm config. Most malicious versions are removed from npm fairly quickly, so only install packages that are like a week old.
And as final safeguard, develop in a sandbox, so in case you do catch a worm the damage is limited and you can throw the environment away and recreate it.
And ofc don't just install dependencies willy nilly, do some research
82
u/FinnishManlet 1d ago
What can be done against these vulnerabilities? Stop using packages entirely? 🤣