On May 11, 2024, TanStack suffered a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious versions within six minutes. The attackers exploited GitHub Actions c…
Seed4j-mcp is a new open-source Model Context Protocol (MCP) server that allows AI agents like Claude Code and Cursor to control the seed4j application generator, enabling them to scaffold Spring Boot…
Three versions of the widely used npm package node-ipc (9.1.6, 9.2.3, and 12.0.1) were compromised on May 14, 2026, after an attacker took over the co-maintainer account "atiertant" and published mali…
Five typosquatting npm packages published by accounts named "superbase" and "micresoft" contain a hidden 4.5 MB ELF binary that executes automatically upon `npm install` and, through a hijacked `Sessi…
On May 11, 2026, an attacker compromised the TanStack Router/Start repository and published 84 malicious npm package versions across 42 packages by exploiting a pull_request_target vulnerability, GitH…
A malicious npm package named "exiouss" was published on May 1, 2026, by the account "loltestpad" as a rebranded version of the previously removed "godsplan" package, now bundling a PowerShell script …
The PyTorch Lightning deep-learning framework was compromised on PyPI, with versions 2.6.2 and 2.6.3 containing a credential-stealing worm called Shai-Hulud. The malware activates when Python code run…
Setting a minimum release age (cooldown) on dependencies is a low-effort, high-impact defense against supply-chain attacks, as most malicious packages are detected and removed within hours. All three …
The article describes an uninstall script for the Beads (bd) tool that performs a comprehensive cleanup of all its traces from a system. By default, the script runs in dry-run mode to show what would …
Deno 2.6 introduces a new tool called `dx`, which functions as an equivalent to `npx` for conveniently running binaries from npm and JSR packages. The release also adds more granular permission contro…
The article explains that Node.js and npm have a permissive default security model, allowing any installed package code, including malicious scripts, full system access. In contrast, Deno is designed …
The article explains that Bun's package installation is significantly faster than other Node.js package managers because it treats installation as a systems programming problem rather than a JavaScrip…
The article describes "Typosquat Detective," a short online game designed to train users to identify look-alike domains used in phishing attacks. The game tests players on spotting tricks like number-…
The Hex team has launched **diff.hex.pm**, a free web-based tool that generates highlighted git diffs for any Hex package version range directly in a browser. Designed to improve supply chain security…