Follow ZDNET: Add us as a preferred source on Google. Red Hat was the victim of an npm security breach. The company has removed the affected packages. Check whether you use @redhat-cloud-services npm ...
The popular Mastra AI framework, used to build artificial intelligence agents, workflows and retrieval-augmented generation ...
In response to recent software supply chain attacks, NPM version 12 is blocking the automatic script execution at install.
July 2026, blocking install scripts, Git dependencies, and remote URL sources by default. Every team running npm install in ...
The lurking code-bombs lift Discord tokens from users of any applications that pulled the packages into their code bases. A series of malicious packages in the Node.js package manager (npm) code ...
With npm v12, GitHub closes a central attack vector: installation scripts from dependencies will only run after explicit approval from July 2026.
Attackers have poisoned a code package on the npm registry in a novel way, hiding credential-stealing malware in steganographic QR codes embedded in a package purporting to offer a JavaScript utility.
The NPM JavaScript registry has experienced a jump in malware, including packages related to data theft, crypto mining, botnets, and remote code execution, according to security company WhiteSource.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results