Shipping an npm CLI Tool Securely to a Specific Customer — Designing the Build, Sign, and Deliver Pipeline

You want a privately developed npm CLI tool used only inside one customer enterprise, never on the public npm registry. It looks like plain packaging, but in practice you must satisfy three things at once: passing the OS security gates (Gatekeeper and SmartScreen), tamper-evident signing, and a distribution network you can control and audit per customer. Targeting macOS and Windows now with Linux ahead, this post designs build, signing, distribution, and supply-chain hardening as a single pipeline.

Opening a Folder Can Run Malware — A Safe Demo of Developer-Targeted Attacks Disguised as Job Recruiting via VS Code folderOpen and npm Lifecycle Scripts

Attacks that lure developers into running malware-laden repositories under the guise of recruiting or coding tests are on the rise. The steps you take right after git clone (opening the folder in an editor, running npm install) can themselves be the code-execution trigger. I built a demo repository to reproduce that safely on localhost, and here are the design decisions and defenses worth taking away.