Most of the code you ship, nobody on your team wrote. Now an agent picks what to add, too.
Supply chain attack
Also called dependency confusion, install script
Attacking you through something you depend on. A package gets taken over or swapped, you install the update as usual, and its code runs with all the access your program or your laptop has.
A package can run code the moment you install it, with no import needed. A version range like ^1.4.0 accepts new releases on its own, and an agent adds dependencies with less hesitation than you would.
“In CI, install with npm ci --ignore-scripts, so the lockfile decides the versions and its hashes are checked. Before you add any dependency, tell me its name, its owner, its age, and why ten lines of our own code wouldn't do.”