TechnoCat

On closer inspection, preventing post-install would have fixed it too: “The attack exploited a transitive dependency, plain-crypto-js@4.2.1, which executed a postinstall script to deploy the RAT.”

Minimum age would have prevented it in this case.

I always advocate switching to pnpm where install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.

• https://pnpm.io/settings#onlybuiltdependencies
• https://pnpm.io/settings#minimumreleaseage
• https://pnpm.io/blog/2025/12/29/pnpm-in-2025#security-by-default

I run my home services on an extremely low power PC. So I like bare bones.