Surviving supply chain hell

Unfortunately, slave tech doesn't understand security, so we're still dealing with these temporary access tokens, 2FA, and other absolute nonsense. Tons of articles spun up after the Shai Hulud npm disaster, listing dozens security measures intended to patch a broken system, but as we can see from latest headlines, many devs are still scrolling through their phones while their credentials sit in plain text, waiting to be stolen.

There is an argument that dumb devs deserve to be hacked and be automated by AI, but the problem is that many popular libraries are still maintained by these same devs.

Some call for building everything by yourself instead of installing new packages, which is a feasible approach with modern LLMs if you have unlimited tokens and no deadlines. But here is the thing: rewriting existing packages still ends up with a dependency, which you now have to maintain.

So let's cut the bullshit and focus on the most practical tips for surviving the supply chain hell.

While we've seen attacks across different ecosystems, npm is still the most vulnerable one, so let's focus on it as an example. And since people are fucking lazy to read long manuals, here is a simple command that will mitigate most threats and illustrate core security practices that can be applied across other ecosystems.

npm install package@1.2.3 --before=2026-04-20 --save-exact --ignore-scripts

Just save this single command and use it when you need to install or update a package. Let's break it down.

• Never install a package without a version because you can end up with a malicious dependency.
• For the same reason, stop using npm update or npm audit fix to update packages.
• If you need to update a package, use the above command to install a specific version.
• Always check the latest version of the package via official npm website before installing it.
• Also, search the web for recent attacks with "package-name npm supply chain".
• Do not install a freshly published version unless you're certain that it's legit.
• Set --before flag to at least a week behind the current date.
• Use --save-exact to pin your dependency to a specific version.
• Add --ignore-scripts to prevent execution of malicious scripts.

And if you use aliases, then add alias-name@npm: before the package name, e.g.:

npm install pkg-v2@npm:package@2.1.0 --before=2026-04-20 --save-exact --ignore-scripts

There you go. Stick to this simple command and you'll prevent most of the disasters. Also, consider using bun for your next project.

And if you want to level up your game further, then here are a few more short tips.

• Always use npm ci instead of npm install as it installs exact versions from your package-lock.json.

• Add .npmrc to your project root with the following flags enabled:

save-exact=true
ignore-scripts=true

• Never store access tokens or other secrets in plain text. Use a password manager or encrypt your npm token with openssl.

• Lastly, always sign all git commits with a GPG key and make sure that your deployment scripts verify these signatures.

gpg --full-generate-key

And then add your gpg key to your .git/config

[user]
  name = darkvegas
  email = fuck@slave.tech
  signingkey = 76A9926BF4EA565D
[commit]
  gpgsign = true
[tag]
  gpgSign = true

That's it, your terminal will prompt you to enter a password for the gpg key when you try to commit. And consider installing tig as it's the best tool for managing your git repo.