npm, the system most web developers use to pull in ready-made chunks of code, has released a version that stops those chunks from automatically running setup instructions when they are installed. From now on a developer has to approve that step. Security researchers at Checkmarx say it helps, but expect attackers to shift to hiding their code somewhere else.
What this changes for you: almost nothing directly, and that is worth understanding.
Almost every modern website is assembled partly from code written by strangers. A booking form, an image slider, a payment integration: rather than write these from scratch, developers pull in packages that thousands of other sites also use. npm is the warehouse those packages come from. It saves an enormous amount of time, and it is completely normal practice.
The risk is that if someone poisons a popular package, everyone who installs it gets the poison too. Until now, the simplest trick was to attach instructions that ran the instant a package was installed, on the developer's own computer. That is the door npm has just closed.
The honest caveat in the reporting is that closing one door raises the cost of an attack without removing the reason for it. Checkmarx expects attackers to hide malicious behaviour deeper in the code, where it runs later. There is also a human weakness: developers now get asked to approve these scripts constantly, and most are harmless, so people will get used to clicking yes without looking.
For a small business owner, none of this is something you can act on directly. You are not running installs. But it does tell you something useful about how your site gets built, and it gives you a reasonable question to ask.
What to do
Nothing today. Next time you speak to whoever maintains your site, ask two things. First, how often are the third-party packages behind the site updated, and who checks them. Second, if something did go wrong, how quickly could the site be restored from a clean backup. Neither question needs a technical answer from you. You just want to hear that someone has thought about it.
Reported by:
