npm

Developer Tools 9 min Two Registries Made Time a Security Control. Our Own Files Say When That Works. GitHub gave Dependabot a three-day cooldown on 14 July and PyPI began rejecting new files on releases older th... KE Kenji Tanaka 8 Aug Developer Tools 6 min npm v12 Is Here, and It Turns Off a Default That Has Run Arbitrary Code for a Decade npm v12 went generally available on 8 July, flipping install scripts, Git dependencies and remote-URL packages... KE Kenji Tanaka 11 Jul Developer Tools 5 min npm v12 Flips Three Install Defaults From Automatic to Opt-In — Prepare Your Pipelines Now GitHub's npm v12, due July 2026, turns three things npm install does automatically today into choices you have... KE Kenji Tanaka 19 Jun Cybersecurity 7 min Miasma Returns With 'Phantom Gyp': npm Worm Sidesteps the Install-Script Defences Teams Just Deployed On 3 June, two days after the Red Hat npm compromise, the Miasma worm returned with a new delivery trick: a 15... CY Cyber Team 11 Jun Developer Tools 7 min Miasma: How a Hijacked CI Pipeline Shipped Malicious npm Packages With Valid Provenance The Miasma supply-chain attack didn't typosquat or steal an npm token — it hijacked a maintainer's CI pipeline... KE Kenji Tanaka 8 Jun Cybersecurity 5 min Supply Chain Attacks Hit Record 454,600 Malicious Packages in 2025 — And AI Is to Blame Malicious packages in public software repositories hit 454,600 in 2025, up from 55,000 in 2022. AI-assisted cr... CY Cyber Team 28 Apr