Living With Deep Dependency Structures

At the time of writing this, we are in the aftermath of Shai-hulud 2.0 1 , which came on the back of the two first rounds of attacks from the first version of Shai-hulud 2 3 . Supply chain attacks is nothing new under the sun, and the JavaScript ecosystem is by no means the only one vulnerable to these kinds of attacks. But we do have some special circumstances that make life as JavaScript…