#Npm

Shai-Hulud Returns, and Provenance Signed the Malware

The worm behind the keyv compromise rode a legitimate GitHub Actions pipeline straight past npm's newest defenses.

Article · 1w ago5

Block Malicious npm Packages in CI with Socket.dev

Wire Socket's supply-chain scanner into GitHub Actions to stop typosquats and install scripts before merge.

Tutorial · 1w ago0

Your Best npm Defense Is Waiting 24 Hours

Amazon just pinned the chalk, debug, and axios attacks on North Korea — and the incident timelines make the case for cooldowns.

Article · 1w ago0

npm Breaks Its Oldest Promise to Kill the Worm

GitHub's new defaults across npm and Actions attack every stage of the self-replicating supply chain playbook.

Article · 2w ago4

Supply Chain Security's Newest Control Is a Calendar

Dependabot's three-day default cooldown and PyPI's 14-day release freeze bet that patience beats scanners.

Article · 2w ago0

npm's Cooldown Works Because You Never Vetted Anything

The security-theater critique misreads who actually catches registry malware — but it's right about what attackers do next.

Article · 3w ago0

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 3w ago4

Automate Versioning and Changelogs with Changesets in a pnpm Monorepo

Set up Changesets so every PR carries its own version bump and changelog entry, then let GitHub Actions handle the version PR and npm publish on merge.

Tutorial · 1mo ago0

The OIDC Double-Edge: Inside the Injective SDK Backdoor

A compromised maintainer account and trusted publishing pipeline expose the limits of passive dependency scanning.

Article · 1mo ago0

Miasma Proves Trusted Publishing Can Backfire Spectacularly

The self-propagating Miasma worm exploits GitHub Actions OIDC and phantom build files to turn security standards against developers.

Article · 1mo ago0

npm v12 Kills Auto-Run Scripts: What Developers Must Do

GitHub is finally disabling automatic lifecycle scripts in npm v12, forcing a major shift in dependency security.

Article · 1mo ago1

North Korean Hackers Poison Mastra AI in npm Attack

The compromise of the Mastra AI framework exposes critical gaps between CI/CD provenance and registry-level publish permissions.

Article · 1mo ago1

How a Fake LinkedIn Job Offer Delivered a Node Backdoor

Attackers are using stolen identities and malicious npm lifecycle scripts to target developers during the recruitment process.

Article · 1mo ago4

Hundreds of AUR Packages Trojanized with Malicious npm Dependency

A widespread supply chain attack on the Arch User Repository injects an infostealer via malicious npm install scripts.

News · 2mos ago0

npm v12 Is About to Stop Running Your Install Scripts — Here's What to Audit

The next npm major flips lifecycle scripts, Git, and remote-URL dependencies from opt-out to opt-in. The warnings are already live in 11.16.0, so you have until July to find out what breaks.

News · 2mos ago5