Thousands of fake packages flood npm registry in major attack - here's what we know

Cybersecurity researchers Endor Labs discovered more than 43,000 spam packages which took almost two years to upload in a ...
TMCnet

Arcjet Expands Framework Support with Native Nuxt and React Router SDKs

SAN FRANCISCO, Nov. 12, 2025 (GLOBE NEWSWIRE) -- Arcjet, the security platform that ships with your code, today announced the release of native Software Development Kits (SDKs) for Nuxt and React ...

Dangerous npm packages are targeting developer credentials on Windows, Linux and Mac - here's what we know

Recently, security researchers Socket found 10 packages on npm targeting software developers, specifically those who use the npm (Node Package Manager) ecosystem to install JavaScript and Node.js ...
The Record

Malware found in npm package with millions of weekly downloads

A massively popular JavaScript library (npm package) was hacked today and modified with malicious code that downloaded and installed a password stealer and cryptocurrency miner on systems where the ...
TechRadar

A terrifying, self-replicating malwaere has infected npm packages with over 2 million downloads per week - here's how to stay safe

A new supply-chain attack compromised at least 187 npm packages, targeting developer secrets across software projects Shai-Hulud worm looks to steal credentials, modify packages, and spread malware ...
TechRepublic

Malware Injected Into Code Packages That Get 2 Billion+ Downloads Each Week

Malware Injected Into Code Packages That Get 2 Billion+ Downloads Each Week Your email has been sent An attack targeting the Node.js ecosystem was just identified ...
CSOonline

Massive npm supply chain attack hits 18 popular packages with 2B weekly downloads

Malware hidden in widely used libraries like chalk and debug hijacked crypto transactions via browser APIs, exposing deep flaws in the open-source trust model. A massive supply chain attack ...
The Hacker News

Malicious npm Package nodejs-smtp Mimics Nodemailer, Targets Atomic and Exodus Wallets

Cybersecurity researchers have discovered a malicious npm package that comes with stealthy features to inject malicious code into desktop apps for cryptocurrency wallets like Atomic and Exodus on ...
Bleeping Computer

Supply chain attack hits npm package with 45,000 weekly downloads

An npm package named 'rand-user-agent' has been compromised in a supply chain attack to inject obfuscated code that activates a remote access trojan (RAT) on the user's system. The 'rand-user-agent' ...
NBC DFW

I took a 2-day ‘vibe coding' class and successfully built a product. Here are my biggest takeaways

As someone who chats with startup founders for a living, I've always admired the "builders." I have a lot of respect for their technical ability to dream up an idea and code it into existence, but ...
WBUR

How elephants react to an earthquake

During a 5.2-magnitude earthquake on Monday, video footage shows a group of elephants forming what experts call an “alert circle," a protective formation to shield their young. And as NPR’s Rebecca ...