Why npm audit fails during the critical first hours of a supply-chain attack

When the ua-parser-js npm token was stolen in October 2021, a malicious release remained live for roughly four hours while npm audit reported zero vulnerabilities throughout, exposing the limits of scanner-first incident responses. Security experts recommend that teams begin any supply-chain alert by precisely defining the affected package names, version ranges, and exposure timestamps before touching a terminal. Lockfiles — not package.json semver ranges — are the only reliable record of what actually installed on a given date, and teams must search git history rather than just the current state, since a malicious version may have been replaced before the investigation begins. Egress logs from proxies or VPC flow data serve as the primary evidence of whether a payload executed and exfiltrated data, yet many teams discover they have no such logs at all. Any secret accessible from a system where the compromised package ran should be treated as compromised, with cloud credentials and npm automation tokens prioritized for rotation given how quickly they can cause further damage.