From Composer to Decomposer: When Dependencies Go Rogue

September 2025 has been a wake-up call for anyone who thought supply chain attacks were theoretical problems. In just one week, two devastating attacks hit the Node.js ecosystem, compromising packages with over 2 billion weekly downloads and demonstrating just how vulnerable our modern development practices have become.