Microsoft’s open-source shopping spree has claimed another victim: npm. [Nat Friedman], CEO of GitHub (owned by Microsoft), announced the move recently on the GitHub blog. So what motivated the ...

A recent supply chain hack has seen malware injected into NPM packages with over 2.6Bn weekly downloads after compromising a maintainer’s account in a phishing attack. The NPM attack is causing a lot ...

A new cyberattack has put millions of crypto users on alert after hackers slipped malicious code into NPM, the software registry that powers thousands of apps and websites, including many tied to ...

Shai Hulud v2 infected 500+ npm packages (700+ versions) and spilled into Java/Maven — yikes. Compromised packages run a preinstall loader that downloads Bun and executes a 10MB obfuscated payload ...

The NPM ecosystem is once again facing a serious supply chain attack. While the previous Shai-Hulud infection was mainly ...

Ten typosquatted npm packages delivered infostealing malware to nearly 10,000 systems Malware targeted system keyrings, bypassing app-level security to steal decrypted credentials Affected users must ...

North Korean hackers intensify their efforts against blockchain and Web3 developers, using nearly 200 malicious npm packages ...

Concerned users can set up their own backup system if they don’t trust the steps NPM Inc. has taken to prevent problems The NPM registry of JavaScript packages has become a critical cog in the ...

Here at Hackaday we love the good kinds of hacks, but now and then we need to bring up a less good kind. Today it was learned that the NPM package ua-parser-js was compromised, and any software using ...