npm Supply Chain Attacks Expose Gap in Artifact-Level Dependency Auditing

When a compromised npm package is reported, teams often check their current dependency tree — but this can miss vulnerable versions that existed only briefly during a past build. The Keyv-related package compromise, disclosed by Aikido on August 4, illustrated how a malicious release can spread and be patched before most teams finish assessing their exposure. The core challenge is that modern CI pipelines, lockfile updates, and Docker caching mean a clean scan today says little about what an artifact built yesterday actually contained. Experts argue the useful unit of analysis is not the current repository state but a specific artifact tied to a specific build and its resolved package set. A proposed approach involves accepting lockfiles, build timestamps, artifact digests, and CI logs to reconstruct past builds and classify exposure as confirmed, possible, or unknown — with human review required before any remediation action.