# Supply-chain compromise

> A dependency published a malicious version, and a deploy installed it. The package ran in the App Servers and shipped data out.

## What happens

A dependency published a malicious version, and a deploy installed it. The package ran in the App Servers and shipped data out.

## How to prevent it

Dependency scanning catches a published backdoor before the build installs it; Deno permissions keep a package from reading what it does not need.

The postmortem opens the first of these that you do not own yet:

- [Dependency scanning](https://wiki.playquorum.dev/research/dependency-scanning.md)
- [Deno](https://wiki.playquorum.dev/research/deno.md)

## Components it hits

[App Server](https://wiki.playquorum.dev/components/server.md)

## Facts

SEV1 Supply-chain compromise
- **First Era:** [Series B](https://wiki.playquorum.dev/eras/series-b.md)
- **Starts at:** SEV1
- **Escalates to:** SEVnull
- **Lasts:** 1.5 min

## See also

- [Incidents](https://wiki.playquorum.dev/incidents.md)

Source: https://wiki.playquorum.dev/incidents/supply-chain