The Supply Chain Security Audit Nobody Told You to Run (Until It Was Too Late)

Last year, a single malicious npm package compromised thousands of projects. The package had 2 million weekly downloads, a clean README, and a GitHub star count that made it look legitimate. The payload? A credential harvester that ran silently on postinstall . If you're not auditing your dependency supply chain, you're one npm install away from a very bad day. Here's how I built a practical, LLM-assisted audit workflow that runs in CI and catches malicious packages before they reach production.