npm 12 disables install scripts by default, requiring explicit approval to reduce dependency-based code execution risks.

July 2026, blocking install scripts, Git dependencies, and remote URL sources by default. Every team running npm install in ...

The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took ...

An active campaign named ‘PhantomRaven’ is targeting developers with dozens of malicious npm packages that steal authentication tokens, CI/CD secrets, and GitHub credentials. The activity started in ...

Amazon researchers discovered more than 150,000 malicious packages in the NPM registry, in what they called "a defining moment in supply chain security." The packages were part of a token farming ...

TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious package versions in just six minutes, exposing ...

A security researcher and system administrator has developed a tool that can help users check for manifest mismatches in packages from the NPM JavaScript software registry. Last week, a former ...