node-gyp

A developer at bol migrated the company's five-year-old Backstage internal developer platform from Yarn 4 to pnpm, a move motivated by Git worktree workflows that let parallel coding agents work in se…

A new variant of the Miasma worm has been discovered exploiting npm's binding.gyp build file to execute malicious code during package installation, bypassing traditional package.json script audits. Th…