The original title is "A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack"

Short summary

A social-engineered PR attempted to inject a malicious npm registry redirect into an open-source project using just two lines of config to route all package installations to an attacker's HTTP server. The attack exploited trust in an aged contributor profile and plausible refactor description to bypass human review. Concrete defenses: CODEOWNERS protection for .npmrc and CI checks to reject non-HTTPS or IP-based registries.

• •Two-line supply chain attack used social engineering and registry manipulation to execute arbitrary code during npm install
• •Attacker created aged profile with legitimate presence, crafted plausible refactor PR with security-minded language
• •Provide defenses: restrict .npmrc with CODEOWNERS; CI check to reject suspicious registry configuration

Generated with AI, which can make mistakes.