• 5 min read
• API Stronghold Team
npm postinstall Scripts Can Read Your .env. Most Projects Let Them.
The strapi-plugin-events attack used a postinstall hook to exfiltrate secrets. This vector isn't new. What's new is how often it works.
supply chain npm API keys secrets management credential security
