One letter off, with an install script
A developer added a dependency by hand. Compare package names with what the team normally uses, find the typosquat, and read the postinstall script it runs on every npm install.
Briefing
checkout-web’s CI started making an outbound request during npm ci last week. The only dependency change was in package.json, typed by hand during a late fix.
npm runs a package’s preinstall, install, and postinstall scripts automatically. A typosquatted package only needs someone to mistype a name once.
dev-laptop · Supply chain
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.