Invisible Infrastructure: How Single-Maintainer npm Packages Threaten Global Software Supply Chains

The article exposes a critical vulnerability in JavaScript's supply chain: 26 npm packages collectively downloaded over 10 billion times each week are maintained by single individuals. These invisible dependencies—from glob to cross-spawn—are embedded in every major build tool and CI/CD system, meaning a single security breach could impact billions of developers globally. Even packages dismissed as harmless, like type definitions, can be weaponized during builds to compromise entire deployment pipelines.