Curated security research, vulnerabilities, advisories and tools for practitioners.

#npm

Security coverage tagged npm. (Page 2)

31.

Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware

blog | 2026-04-29 15:14 | wiz.io | original ↗ | #cloud | #supply-chain | #kubernetes

32.

Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

blog | 2026-04-29 00:00 | aikido.dev | original ↗ | #supply-chain | #secrets | #malware

33.

Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm

blog | 2026-04-23 00:00 | aikido.dev | original ↗ | #cloud | #supply-chain | #credential-theft

34.

Delivered by Trust: What the Axios Supply Chain Attack Means for Security Leaders

incident | 2026-04-06 00:00 | bishopfox.com | original ↗ | #supply-chain | #incident-response | #npm

35.

Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444

incident | 2026-04-01 00:00 | hunt.io | original ↗ | #supply-chain | #malware | #npm

36.

Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign

blog | 2026-04-04 09:36 | wiz.io | original ↗ | #ai-security | #supply-chain | #github-actions

37.

Glassworm Strikes Popular React Native Phone Number Packages

blog | 2026-03-16 00:00 | aikido.dev | original ↗ | #supply-chain | #malware | #npm

38.

What is Slopsquatting? The AI Package Hallucination Attack Already Happening

blog | 2026-02-20 00:00 | aikido.dev | original ↗ | #ai-security | #npm | #llm

39.

Vulnerability or Not a Vulnerability?

blog | 2026-02-16 14:16 | CVE-2023-42282 | jfrog.com | original ↗ | #ai-security | #vulnerability-management | #open-source

40.

Introducing Aikido Package Health: a Better Way to Trust Your Dependencies

blog | 2026-02-03 00:00 | aikido.dev | original ↗ | #supply-chain | #devsecops | #open-source

41.

Snipping the Long Tail of Shai-Hulud 2.0

blog | 2025-12-30 15:21 | wiz.io | original ↗ | #cloud | #supply-chain | #npm

42.

Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact

incident | 2025-12-01 17:52 | wiz.io | original ↗ | #supply-chain | #incident-response | #npm

43.

Shai-Hulud npm supply chain attack – new compromised packages detected

incident | 2025-11-24 19:03 | jfrog.com | original ↗ | #cloud | #supply-chain | #malware

44.

Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets

incident | 2025-11-24 10:27 | wiz.io | original ↗ | #supply-chain | #secrets | #malware

45.

Safe Chain now enforces a minimum package age before install

blog | 2025-11-28 00:00 | aikido.dev | original ↗ | #supply-chain | #devsecops | #malware

46.

Shai-Hulud 2.0: What Security Leaders Need to Do Now

blog | 2025-11-26 15:05 | hackerone.com | original ↗ | #supply-chain | #secrets | #malware

47.

Critical RCE Vulnerability CVE-2025-11953 Puts React Native Developers at Risk

research | 2025-11-04 14:15 | CVE-2025-11953 | jfrog.com | original ↗ | #rce | #supply-chain | #npm

48.

Top 10 JavaScript Security Vulnerabilities in Modern Web Apps

blog | 2025-11-04 00:00 | CVE-2020-11023 | aikido.dev | original ↗ | #npm | #xss | #vulnerabilities

49.

The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties

blog | 2025-10-31 00:00 | aikido.dev | original ↗ | #supply-chain | #malware | #github

50.

Top Software Supply Chain Security Vulnerabilities Explained

blog | 2025-10-22 00:00 | aikido.dev | original ↗ | #supply-chain | #open-source | #npm

51.

Shifting Security ‘Lefter’ Than Left Is The Key To Avoiding Risky Packages

blog | 2025-09-19 20:01 | jfrog.com | original ↗ | #npm | #jfrog | #supply-chain-attack

52.

Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware

blog | 2025-09-16 14:04 | wiz.io | original ↗ | #supply-chain | #secrets | #malware

53.

Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond

incident | 2025-09-09 12:20 | wiz.io | original ↗ | #supply-chain | #cryptocurrency | #npm

54.

How to survive supply-chain attacks

blog | 2025-09-13 12:00 | osec.io | original ↗ | #supply-chain | #malware | #cryptocurrency

55.

New compromised packages identified in largest npm attack in history

blog | 2025-09-09 13:51 | jfrog.com | original ↗ | #malware | #npm | #phishing

56.

duckdb npm packages compromised

blog | 2025-09-09 00:00 | aikido.dev | original ↗ | #supply-chain | #malware | #npm

57.

s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know

incident | 2025-08-27 12:00 | wiz.io | original ↗ | #ai-security | #supply-chain | #secrets

58.

8 Malicious npm Packages Deliver Multi-Layered Chrome Browser Information Stealer

research | 2025-08-27 15:26 | jfrog.com | original ↗ | #supply-chain | #npm | #obfuscation

59.

Popular nx packages compromised on npm

blog | 2025-08-27 00:00 | aikido.dev | original ↗ | #supply-chain | #malware | #credential-theft

60.

Detecting and Preventing Malware in Modern Software Supply Chains

blog | 2025-08-20 00:00 | aikido.dev | original ↗ | #supply-chain | #malware | #npm

← Previous More →