Section 03 of 05

What npm, Node, and a deploy do to your code

npm, the software supply chain, Node and its neighbors, and the behavior that only appears once the code is running somewhere you do not control.

A dependency graph, a lockfile and a release pipeline each make a narrow promise, and most incidents happen in the gap between the promise people assume and the one that was made. These articles read the artifacts directly: the lockfile, the attestation payload, the registry response.