Typosquat2
A malicious package named to be mistaken for a popular one: a swapped letter, a missing dash, an extra word.
Stops it: Allow lists, lookalike name checks, and reviewing every new dependency before it lands.
Dependency confusion2
A public package published under the name of a private one, at a higher version, so a build that looks in both places picks it.
Stops it: Reserved names that are never fetched from outside, and one upstream per scope with no fallback.
Account takeover7
A real maintainer account is phished or its token stolen, and a malicious version of a trusted package is published.
Stops it: Cooling off new versions, lockfiles, a kill switch, and phishing resistant MFA for maintainers.
Malicious maintainer2
Someone gains the trust of a project, or builds a useful package, and then ships harmful code on purpose.
Stops it: Reviewing changes in dependencies, provenance, and watching for new install scripts.
Sabotage and removal3
A maintainer deletes, breaks or weaponizes their own package, as protest or in anger.
Stops it: A cache of every version you use, pinned versions, and a kill switch.
CI/CD compromise3
A pipeline, a CI service or a third party action is abused to steal secrets or publish poisoned releases.
Stops it: Least privilege CI tokens, actions pinned to a full SHA, short lived OIDC credentials, egress control.
Vulnerable dependency1
Not an attack on the supply chain itself: a serious flaw in a widely used component that everyone downstream inherits.
Stops it: An inventory of what runs where, SBOMs, vulnerability monitoring and fast patching.
Domain or CDN takeover1
An expired maintainer domain or a sold CDN is used to take over accounts or serve altered code.
Stops it: Self hosting scripts, subresource integrity, and watching maintainer email domains.
Self spreading worm3
Malware that steals publish tokens and uses them to infect more packages by itself.
Stops it: Cooling off, a kill switch, short lived publish tokens and fast token rotation.
One square per incident on this page, colored by type. Select a square to jump to it.
This counts what we chose to include, not every attack that happened, and the later years are busier partly
because far more researchers are watching the registries now.