Engineering 10 min read How a Clean Next.js Repo Ran Malware on Every npm run dev A Next.js project I was handed ran obfuscated code from a private npm package on every dev server start. How it hid, and the audit I run now. October 21, 2026 Read → npmSupply Chain SecurityNext.jsTailwind CSSFreelancing