JavaScript security

Tag: JavaScript security

JavaScript

npm v12 lands in July and breaks three things: install scripts, git deps, remote URLs. ...

June 10, 2026

Security

The Mini Shai-Hulud worm hit 42 TanStack npm packages in a six-minute window and produced ...

May 31, 2026

JavaScript

vm2 — the Node.js library with 1.5 million weekly downloads used to run untrusted JavaScript ...

May 24, 2026

JavaScript

TeamPCP’s Mini Shai-Hulud worm poisoned 637 npm packages across the @antv ecosystem on May 19. ...

May 21, 2026

JavaScript

Axios npm compromised March 31, 2026 via maintainer hijacking. Self-erasing RAT deployed across macOS, Windows, ...

March 31, 2026

Hardware

npm's lotusbail malware stole WhatsApp from 56K downloads. Still live Dec 2025. Uninstalling isn't enough—attacker's ...

December 23, 2025