Every npm install You Run Is a Bet

Every npm install you run is a bet.

Not a metaphor. Not an exaggeration. A real bet.

A few days ago attackers succeeded in poisoning the build cache of TanStack – one of the most popular libraries in JavaScript, with millions of downloads a week.

Nobody stole credentials. Nobody compromised a maintainer’s account. The system was simply designed in a way that allows this.

And that is the part that genuinely troubles me

We live in an era where developers run npm install across dozens of packages a day without reading a single line of the code they are bringing into the project. That is not negligence – it is how the construction of the system works. Nobody sits down to read the entire dependency tree of 800 packages.

But now add vibe coding to that. Developers who ask an AI to build them a feature, receive a list of dependencies, and copy-paste it without asking questions.

“The model recommended it, so it is probably fine.”

No.

A model recommends what was popular in its training data. It does not know what was compromised last week. It does not know which maintainer handed the package over to somebody else. It has no opinion about a build cache that can be poisoned, because the question was never in front of it.

What this actually asks of you

Pin your versions. Read what changes when a dependency updates, at least for the ones that run at build time. Treat the pipeline as an attack surface, because attackers already do. And when a tool hands you a dependency list, remember that it is a suggestion drawn from the past, not a safety assessment of the present.

I first shared a version of this as a LinkedIn post on 2026-05-25. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula