Building a First Line of Defense Against Software Supply-Chain Attacks with pnpm

As seen in the recent cases of the LiteLLM and Axios packages, Software Supply-Chain Attacks—in which attackers hijack the accounts of trusted open-source packages and inject malicious code into transitive dependencies—are on the rise.

Attackers particularly exploit the postinstall stage among npm's lifecycle scripts. When a user installs a package, malicious scripts can run in the background without any separate permission request, stealing sensitive information such as .env files, AWS Credentials, and SSH Keys.

In the Axios case, the attacker inserted a typosquatting package called plain-crypto-js into the dependency tree, using it to send the user's environment variables to a C2 server. To defend against this, Inflab has adopted pnpm to strictly manage its dependency structure and respond to security threats.