In this post, Lorenzo Susini demonstrates that runtime security can be valuable to identify software supply chain attacks. As an example, this is the process tree of a malicious npm package harvesting credentials