Tag
11 articles tagged #npm.
P.01The keyv and cacheable attack poisoned 2,234 package versions in one day, and it won't be the last. Here's the concrete checklist for install scripts, provenance, lockfile audits, and CI token scoping that actually reduces your exposure.
P.02A compromised maintainer account on August 4 turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials from packages with tens of millions of weekly downloads. Here's what happened and how to check if you were hit.
P.03On August 4, 2026, a compromised maintainer account pushed malware into keyv, cacheable, and seven other npm packages with 500 million-plus combined weekly downloads. Socket caught it in six minutes. Here's how the worm actually worked and what it targeted.
P.04pnpm versions before 10.34.0 and 11.4.0 could send your unscoped npm auth token to whatever registry a repository's .npmrc pointed at. Here's how the leak works, who's exposed, and how to check and fix it.
P.05Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.
P.06npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.07A GitHub Actions misconfiguration let an attacker open dozens of pull requests, steal a privileged bot token, and push a malicious @asyncapi/generator release to npm. Here's what happened and how to check your own workflows.
P.08On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.09npm v12, shipped July 8, 2026, blocks preinstall/install/postinstall scripts, Git dependencies, and remote tarball installs unless you explicitly allow them. Here's what breaks, why it's happening now, and the exact commands to migrate a real project.
P.10In May and June 2026, two separate supply chain attacks hit the npm ecosystem — TanStack (42 packages) and React Native Aria (17 packages). They used different entry points, had different payloads, and should change how every team handles third-party dependencies.
P.11Our curated list of npm packages that make it into every CODERCOPS project. Each one battle-tested across 30+ production apps with alternatives we considered.