Learn from ESLint / npm

When Open Source Turns Against You:
The ESLint Supply-Chain Attack

In 2018, a compromised npm account injected malicious code into ESLint, stealing npm tokens from unsuspecting developers. This supply-chain attack highlighted the fragility of open-source ecosystems. Incident Drill helps your team prepare for and respond to similar threats.

ESLint / npm | 2018 | Supply-chain Attack

Practice This Scenario →

The Growing Threat of Supply-Chain Attacks

Modern software relies on a vast network of dependencies. This creates a **vulnerable attack surface** that malicious actors exploit. The ESLint attack demonstrated how a single compromised package can **infect thousands of systems**. Companies must proactively train their engineers to **detect and mitigate these risks**.

PREPARE YOUR TEAM

Prepare Your Team with Incident Drill

Incident Drill provides realistic incident simulations based on real-world events like the ESLint attack. Your team will practice **identifying malicious code**, **containing the breach**, and **recovering systems** under pressure. Build confidence and resilience with hands-on training.

🚨

Realistic Simulations

Experience the chaos of a supply-chain attack in a safe, controlled environment.

🕵️‍♀️

Threat Hunting Practice

Learn to identify suspicious code and compromised accounts.

🛡️

Containment Strategies

Practice isolating infected systems and preventing further spread.

📈

Incident Analysis

Analyze the root cause and develop strategies to prevent future attacks.

🤝

Team Collaboration

Improve communication and coordination during critical incidents.

📚

Post-Incident Review

Learn from mistakes and continuously improve your security posture.

WHY TEAMS PRACTICE THIS

Master Supply-Chain Incident Response

✓ Identify and contain supply-chain attacks faster
✓ Reduce the impact of security breaches
✓ Improve team communication and coordination
✓ Strengthen your overall security posture
✓ Meet compliance requirements
✓ Build a culture of security awareness

2018

Compromised npm Account Breach

+1 Hour

Malicious ESLint Packages Published Malware

+2 Hours

Stolen npm Tokens Transmitted Data Exfiltration

+4 Hours

Vulnerability Discovered Detection

+6 Hours

Malicious Packages Removed Remediation

How It Works

Step 1: Detection

Identify anomalies in package dependencies and network traffic.

Step 2: Containment

Isolate affected systems and prevent further token exfiltration.

Step 3: Remediation

Remove malicious packages and revoke compromised tokens.

Step 4: Analysis

Determine the root cause and implement preventative measures.

EXPLORE MORE

Related Incidents

Be Prepared. Join the Incident Drill Waitlist.

Don't wait for the next supply-chain attack to strike. Sign up for Incident Drill and start training your team today.

Get Early Access →

✓ Founding client discounts ✓ Shape the roadmap ✓ Direct founder support

When Open Source Turns Against You:The ESLint Supply-Chain Attack