Defending npm Against Automated Supply Chain Attacks

npm's automatic execution of lifecycle scripts exposes millions of developers to supply chain attacks. The Shai-Hulud worm family has compromised hundreds of packages and stolen thousands of credentials by exploiting this design feature. np-audit addresses this critical gap by statically analyzing install scripts before execution, providing the protection npm's built-in safeguards lack.