[LinkedIn] NPM's supply chain problem is not going to go away

NPM's supply chain problem is not going to go away.

Socket flagged a TanStack brand-squat this week. 84 packages affected.

What to actually do: set a minimum release age, harden Bun installs with trusted dependency allowlists, use Renovate dependency governance, run PR dependency risk checks, and scan lockfiles daily with OSV.

When code isn't the attack surface, transitive dependencies are.