#npm
#npm

Information security

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

2 days ago

Information security

Worm flooding npm registry with token stealers still isn't under control

more#supply-chain-security

Information security

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

#supply-chain-attack

2 days ago

Information security

Crims flood npm with 150K+ junk packages to farm TEA tokens

fromInfoQ

4 weeks ago

Information security

NPM Ecosystem Suffers Two AI-Enabled Credential Stealing Supply Chain Attacks

fromDevOps.com

Information security

Shai-Hulud Attacks Shake Software Supply Chain Security Confidence - DevOps.com

Information security

Self-propagating supply chain attack hits 187 npm packages - DataBreaches.Net

Information security

Self-propagating worm fuels latest npm supply chain attack

Information security

40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials

2 days ago

Information security

Crims flood npm with 150K+ junk packages to farm TEA tokens

fromInfoQ

4 weeks ago

Information security

NPM Ecosystem Suffers Two AI-Enabled Credential Stealing Supply Chain Attacks

fromDevOps.com

Information security

Shai-Hulud Attacks Shake Software Supply Chain Security Confidence - DevOps.com

Information security

Self-propagating supply chain attack hits 187 npm packages - DataBreaches.Net

Information security

Self-propagating worm fuels latest npm supply chain attack

Information security

40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials

more#supply-chain-attack

4 days ago

Over 46,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

The coordinated campaign has so far published as many as 46,484 packages, according to SourceCodeRED security researcher Paul McCarty, who first flagged the activity. The end goal is quite unusual - It's designed to inundate the npm registry with random packages rather than focusing on data theft or other malicious behaviors. The worm-life propagation mechanism and the use of a distinctive naming scheme that relies on Indonesian names and food terms for the newly created packages have lent it the moniker IndonesianFoods.

Information security

#supply-chain

5 days ago

Information security

Malicious npm package sneaks into GitHub Actions builds

Information security

npm hit by PhantomRaven supply chain attack

Information security

Massive NPM Supply Chain Attack Hits Crypto Wallets - DataBreaches.Net

fromTechzine Global

Information security

Supply chain attack via Nx rages on GitHub

Information security

Wave of npm supply chain attacks exposes thousands of enterprise developer credentials

Information security

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

5 days ago

Information security

Malicious npm package sneaks into GitHub Actions builds

Information security

npm hit by PhantomRaven supply chain attack

Information security

Massive NPM Supply Chain Attack Hits Crypto Wallets - DataBreaches.Net

fromTechzine Global

Information security

Supply chain attack via Nx rages on GitHub

Information security

Wave of npm supply chain attacks exposes thousands of enterprise developer credentials

Information security

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

Node JS

Node.js tutorial: Get started with Node

fromnodesource.com

Node JS

15 Recent Node.js Features that Replace Popular npm Packages

Node JS

Node.js 24 drops MSVC support

5 days ago

Node JS

Node.js tutorial: Get started with Node

fromnodesource.com

Node JS

15 Recent Node.js Features that Replace Popular npm Packages

Node.js 24 drops MSVC support

Node.js 24 brings significant updates to the V8 engine and NPM, crucial for JavaScript development.

Information security

Malicious npm packages contain Vidar infostealer

Information security

NPM package caught using QR Code to fetch cookie-stealing malware

fromFuturism

Information security

CrowdStrike Infested With "Self-Replicating Worms"

fromArs Technica

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

JavaScript

npm phishing attack laces popular packages with malware

The npm package 'is' was infected with cross-platform malware due to a phishing attack via a typosquatted clone of the npm site.

fromIT Pro

Developers beware: Malware has been found in a dozen popular NPM packages - here's what you need to know

Over a dozen NPM packages have been compromised, delivering malware that allows attackers to control infected machines.

1 week ago

Information security

Malicious npm packages contain Vidar infostealer

Information security

NPM package caught using QR Code to fetch cookie-stealing malware

fromFuturism

Information security

CrowdStrike Infested With "Self-Replicating Worms"

fromArs Technica

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

JavaScript

npm phishing attack laces popular packages with malware

fromIT Pro

Developers beware: Malware has been found in a dozen popular NPM packages - here's what you need to know

Over a dozen NPM packages have been compromised, delivering malware that allows attackers to control infected machines.

10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

Ten malicious npm packages deliver a multi-stage information stealer using obfuscation, fake CAPTCHA, IP fingerprinting, and a 24MB PyInstaller payload targeting Windows, Linux, and macOS.

fromArs Technica

NPM flooded with malicious packages downloaded more than 86,000 times

Attackers exploited NPM's Remote Dynamic Dependencies to publish over 100 credential-stealing packages that downloaded unseen malicious code from untrusted servers.

#software-supply-chain

Information security

PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs

fromSecuritymagazine

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

Information security

PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs

fromSecuritymagazine

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

more#software-supply-chain

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

#phishing

Information security

175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign

fromCSO Online

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

fromTechRadar

JavaScript

More popular npm packages hijacked to spread malware

Information security

175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign

fromCSO Online

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

fromTechRadar

JavaScript

More popular npm packages hijacked to spread malware

GitHub Boosting Security in Response to NPM Supply Chain Attacks

GitHub will require two-factor authentication for local NPM publishing and deploy short-lived, granular tokens plus trusted publishing to mitigate NPM supply-chain attacks.

GitHub to remove weak security options for npm registry

GitHub is tightening npm publishing security by removing legacy authentication, shortening token lifetimes, enforcing 2FA, and shifting to trusted publishing with short-lived tokens.

fromZDNET

5 ways to spot software supply chain attacks and stop worms - before it's too late

Shai-Hulud is an ongoing, widespread npm software supply-chain worm attack compromising JavaScript packages and posing a major security crisis for JavaScript developers.

Web development

from2ality

Learning web development: Native package managers

Install an OS package manager to get native shell commands (like curl) that npm cannot provide, enabling non-JavaScript tools for web development tasks.

Web development

from2ality

Learning web development: Installing npm packages and bundling

Web apps use npm libraries, tests, and a bundling build step that outputs a single bundle and follows a project file structure.

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Malicious npm packages used Ethereum smart contracts to hide commands and deliver downloader malware, leveraging GitHub repositories to lure developers and evade detection.

npm 'accidentally' removes Stylus package, breaks builds and pipelines

npm has taken down all versions of the real Stylus library and replaced them with a 'security holding' page, breaking pipelines and builds worldwide that rely on the package.

Web development

4 months ago

North Korean XORIndex malware hidden in 67 malicious npm packages

North Korean threat actors delivered malware through 67 malicious npm packages, affecting over 17,000 downloads.

fromInfoQ

Deno 2.3 Now Supports Local NPM Packages

Deno 2.3 enhances local NPM package support and deno compile for streamlined development.

#cybersecurity

fromDeveloper Tech News

Node JS

Veracode unravels 12-layer npm attack to find RAT

Growth hacking

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

Three malicious npm packages targeting Cursor on macOS are stealing user credentials and distributing harmful upgrades to the software.

Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Three malicious npm packages disguised as a Telegram bot library have been found, containing SSH backdoors and data exfiltration functionalities.

fromDeveloper Tech News

Node JS

Veracode unravels 12-layer npm attack to find RAT

Growth hacking

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Three malicious npm packages disguised as a Telegram bot library have been found, containing SSH backdoors and data exfiltration functionalities.

NPM adds Workspaces for managing multiple packages

NPM 7.0.0 introduces Workspaces and automatic peer dependency installation, streamlining package management for developers.

fromSitePoint Forums | Web Development & Design Community

1 year ago

Deno boosts dependency management with JSR

Deno 1.42 includes major updates for Node.js and NPM compatibility, enhancing modules such as async_hooks, crypto, and worker_threads for improved performance.

Node JS

Unhandled Runtime Error ChunkLoadError

The Dockerfile demonstrates a streamlined setup for a Node.js application, starting from the lightweight Node.js 23-alpine image and ensuring the latest npm is installed.

Node JS