I’ve been forseeing a supply chain apocalypse, especially in the NPM ecosystem, coming for years. Exacerbated by LLMs telling people what libraries to use, including versions, and then people just cut and paste that in and walk away. Our standard practice of devs doing all their coding on a messy local machine, just running whatever stacks they’re working with on bare metal, often side by side, just in different virtual environments, always seemed like a powder keg waiting to go off.

Now with glassworm and shai halud, I’m feeling very prescient.