#npm
#npm

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

fromTheregister

JavaScript

npm phishing attack laces popular packages with malware

fromIT Pro

Node JS

Developers beware: Malware has been found in a dozen popular NPM packages - here's what you need to know

Node JS

Package lurking in npm for six years waits to destroy your work

Dozens of malicious packages on NPM collect host and network data

60 malicious NPM packages were found that collect sensitive data and send it to threat actors through Discord webhooks.

Threat actors employed names similar to legitimate packages to deceive developers and infiltrate systems.

60 malicious npm packages caught mapping developer networks

A coordinated malware campaign is targeting npm packages to gather intelligence on developer networks.

fromArs Technica

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

fromTheregister

JavaScript

npm phishing attack laces popular packages with malware

fromIT Pro

Developers beware: Malware has been found in a dozen popular NPM packages - here's what you need to know

Over a dozen NPM packages have been compromised, delivering malware that allows attackers to control infected machines.

Package lurking in npm for six years waits to destroy your work

A malicious npm package, disguised as a legitimate tool, has been uncovered, potentially endangering numerous projects.

The xlsx-to-json-lh package highlights vulnerabilities in package management due to misleading naming.

Dozens of malicious packages on NPM collect host and network data

60 malicious NPM packages were found that collect sensitive data and send it to threat actors through Discord webhooks.

Threat actors employed names similar to legitimate packages to deceive developers and infiltrate systems.

60 malicious npm packages caught mapping developer networks

A coordinated malware campaign is targeting npm packages to gather intelligence on developer networks.

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

fromTechRadar

JavaScript

More popular npm packages hijacked to spread malware

fromCSO Online

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

fromTechRadar

JavaScript

More popular npm packages hijacked to spread malware

more#phishing

npm 'accidentally' removes Stylus package, breaks builds and pipelines

npm has taken down all versions of the real Stylus library and replaced them with a 'security holding' page, breaking pipelines and builds worldwide that rely on the package.

Web development

2 months ago

North Korean XORIndex malware hidden in 67 malicious npm packages

North Korean threat actors delivered malware through 67 malicious npm packages, affecting over 17,000 downloads.

fromInfoQ

2 months ago

Deno 2.3 Now Supports Local NPM Packages

Deno 2.3 enhances local NPM package support and deno compile for streamlined development.

#cybersecurity

Node JS

Veracode unravels 12-layer npm attack to find RAT

Growth hacking

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

Three malicious npm packages targeting Cursor on macOS are stealing user credentials and distributing harmful upgrades to the software.

Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Three malicious npm packages disguised as a Telegram bot library have been found, containing SSH backdoors and data exfiltration functionalities.

Node JS

Veracode unravels 12-layer npm attack to find RAT

Growth hacking

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

fromSitePoint Forums | Web Development & Design Community

Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Three malicious npm packages disguised as a Telegram bot library have been found, containing SSH backdoors and data exfiltration functionalities.

NPM adds Workspaces for managing multiple packages

NPM 7.0.0 introduces Workspaces and automatic peer dependency installation, streamlining package management for developers.

fromInfoWorld

1 year ago

Deno boosts dependency management with JSR

Deno 1.42 includes major updates for Node.js and NPM compatibility, enhancing modules such as async_hooks, crypto, and worker_threads for improved performance.

Node JS

Unhandled Runtime Error ChunkLoadError

The Dockerfile demonstrates a streamlined setup for a Node.js application, starting from the lightweight Node.js 23-alpine image and ensuring the latest npm is installed.

Node JS

fromInfoWorld

Node.js 24 drops MSVC support

Node.js 24 brings significant updates to the V8 engine and NPM, crucial for JavaScript development.