PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

npm v12 delivers one of the biggest security improvements in years

aikido.dev | blog | #supply-chain | #devsecops | #open-source | #malware | #npm | #supply-chain-security | #shai-hulud | #package-registry | #package-manager | #nodejs | #allowlist | #postinstall | #security-defaults | #node-gyp | #install-scripts | #postinstall-scripts
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

npm v12 (July 2026) stops running dependency install scripts by default, requiring an allowlist—closing the postinstall vector exploited by Shai-Hulud and Nx, plus stricter git dependency rules.
Published
Collected

Related coverage

blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
blog · aikido.dev
Shai-Hulud Rises From the Dead after 111 days
The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.
blog · aikido.dev
Good riddance, TeamPCP. Now for the hard part.
This incident analysis explains systemic gaps in package registry security exposed by recent malicious campaigns.
blog · aikido.dev
Shai-Hulud was the best thing to happen to supply chain security
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · about.gitlab.com
Building AI security in the open
GitLab has joined the Open Secure AI Alliance to help advance transparent, adaptable approaches to securing AI systems.
blog · wiz.io
Snipping the Long Tail of Shai-Hulud 2.0
Wiz Research on Shai-Hulud 2.0's long tail: infections ran 100-200 repos/day, 90%+ via a zombie OpenVSX extension; a clean release cut it to a handful, while leaked secrets remain unrotated.
Back