From the source
In addition, we have seen other creative attacks, including a typosquat package named supabase-javascript that appeared on npm, copying our name to phish developers.
We reported it. npm took it down a few hours later, long enough that the package picked up real downloads.
If you build on Supabase, this matters to you.
Edge Functions pull from npm.
The Supabase CLI is on npm. supabase-js , @supabase/ssr , and @supabase/server are all on npm.
Any of these is a credential leak waiting for the wrong update to land.
This post lays out what we are doing about it and what you should do today.
What we are doing about it at Supabase # We kicked off a coordinated response across the company.
The work in flight: Publishing a canonical security guide in our docs.
A single, agent-readable page that tells you exactly what to do.
Hardening our own GitHub Actions.
Our security team finished a pass on pull_request_target usage across the Supabase org months ago and is close to enforcing pinned action SHAs across every repo.
