---
title: "Protecting your Supabase projects from npm supply chain attacks"
description: "The post explains why npm supply-chain attacks matter to Supabase projects: Edge Functions, the Supabase CLI, and packages including supabase-js, @supabase/ssr, and @supabase/server all depend on npm. Attackers can compromise maintainers, register typosquats, or exploit build pipelines; once malicious code reaches node_modules, lifecycle scripts may read environment variables, cloud metadata, tokens, kubeconfig, and SSH keys. The proposed defense is layered: upgrade to pnpm 11, increase minimumReleaseAge to several days, pin sensitive dependency versions, commit and review lockfiles, disable or allowlist install scripts, verify package names, and pin GitHub Actions to full commit SHAs. Supabase is publishing a canonical security guide, hardening its GitHub Actions, adding secret-handling warnings to API documentation, and coordinating communications; the post also recommends rotating credentials after a potentially compromised install and using scanners as supplementary defense."
---

# Protecting your Supabase projects from npm supply chain attacks

[Supabase](https://yomu.fyi/company/supabase) · katerina\_skroumpelou · May 26, 2026

**Type:** Explainer

## Summary

The post explains why npm supply-chain attacks matter to Supabase projects: Edge Functions, the Supabase CLI, and packages including supabase-js, @supabase/ssr, and @supabase/server all depend on npm. Attackers can compromise maintainers, register typosquats, or exploit build pipelines; once malicious code reaches node\_modules, lifecycle scripts may read environment variables, cloud metadata, tokens, kubeconfig, and SSH keys. The proposed defense is layered: upgrade to pnpm 11, increase minimumReleaseAge to several days, pin sensitive dependency versions, commit and review lockfiles, disable or allowlist install scripts, verify package names, and pin GitHub Actions to full commit SHAs. Supabase is publishing a canonical security guide, hardening its GitHub Actions, adding secret-handling warnings to API documentation, and coordinating communications; the post also recommends rotating credentials after a potentially compromised install and using scanners as supplementary defense.

## Context

Supabase projects and tooling consume packages distributed through npm, while npm supply-chain attacks can enter through compromised maintainers, typosquatted names, or compromised build pipelines. Malicious lifecycle scripts can expose credentials and other sensitive files from the installation host.

## Approach / What changed

The post recommends layered defenses: use a newer package manager with release-age controls, pin sensitive dependencies and GitHub Actions to immutable references, review lockfiles, restrict install scripts and non-registry dependencies, verify package identity, avoid unsafe pull\_request\_target workflows, rotate exposed credentials, and optionally add registry scanners. Supabase is also creating documentation, hardening its workflows, adding API documentation warnings, and coordinating communications.

## Takeaways

- pnpm 11 sets a 24-hour minimumReleaseAge by default; the post recommends raising it to three to seven days because many malicious packages are detected and removed within 24 to 48 hours.
- Lifecycle scripts such as preinstall, install, and postinstall can execute malicious package code during installation. The post recommends disabling them where possible or using pnpm's Allow Builds model to allowlist required packages.
- A pull\_request\_target workflow that checks out pull-request code can run attacker-controlled code with access to repository secrets and caches. The post recommends using pull\_request for workflows that touch pull-request code and reserving pull\_request\_target for trusted, no-checkout operations.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [AWS](https://yomu.fyi/topic/aws), [CI/CD](https://yomu.fyi/topic/ci-cd), [Kubernetes](https://yomu.fyi/topic/kubernetes), [Reliability](https://yomu.fyi/topic/reliability)

- Source: [Supabase](https://supabase.com/blog/protecting-your-supabase-projects-from-npm-supply-chain-attacks)
- Source URL: https://supabase.com/blog/protecting-your-supabase-projects-from-npm-supply-chain-attacks
- Ingested by Yomu: 2026-08-30T04:00:54.329Z

[Read original post](https://supabase.com/blog/protecting-your-supabase-projects-from-npm-supply-chain-attacks)