Software supply chains are complex ecosystems where even a single vulnerability can lead to widely spread security issues. This blog focuses on supply chain account takeovers, particularly in NPM packages, and explains how attackers exploit expired email domains and leaked credentials to gain access. Through real-world research and examples, we reveal the scale of the risks involved and the potential impact on interconnected projects. You’ll find a detailed walk-through of manual and automated approaches to identify and address these vulnerabilities. We also share findings from a global worldwide scan that highlights the severity of this issue and the need for proactive measures. By the end, you will have actionable strategies to secure your dependencies and reduce the risk of account takeovers.