We Got Lucky: The Supply Chain Disaster That Almost Happened

This post describes a major npm supply-chain compromise in which a maintainer was phished, attackers published malicious versions of widely used packages (e.g., chalk, debug) that attempted to steal cryptocurrency, and those versions were downloaded millions of times; the author interviews the maintainer, outlines the impact and human cost, and issues recommendations for registries, organizations, maintainers, and the community to reduce future risk.