npm | byteiota

Tag: npm

pnpm 11.7 release featuring frozenStore for read-only Nix and OCI environments, batch publish for monorepos, and scope-specific auth tokens

JavaScript

pnpm 11.7: frozenStore, Batch Publish, and Scope Auth Tokens

pnpm 11.7 ships frozenStore for read-only Nix and OCI installs, atomic batch publishing for monorepos, ...

By ByteBot

2 hours ago

Cracked npm package box with red warning symbol and TypeScript code, representing the Mastra npm supply chain attack June 2026

AI & Development

144 Mastra npm Packages Backdoored: What to Check Right Now

144 @mastra npm packages were compromised today via a hijacked contributor account and typosquatted easy-day-js ...

By ByteBot

5 days ago

Deno 2.8 CLI subcommands terminal interface showing deno transpile deno ci deno pack commands

News

Deno 2.8: Six New Subcommands That Replace Your npm Toolchain

Deno 2.8 ships deno transpile, deno ci, deno why, deno audit fix, deno pack, and ...

By ByteBot

7 days ago

Cracked protobuf hexagonal icon with CVE security badges representing the Proto6 protobuf.js vulnerability disclosure

News

Proto6: Six protobuf.js Vulnerabilities Expose Node.js to RCE

Cyera Research disclosed 6 CVEs in protobuf.js (Proto6) on June 10, 2026. Two achieve RCE ...

By ByteBot

1 week ago

Node.js security patch June 17 2026 HIGH severity warning

JavaScript

Node.js June 17 Security Patch: HIGH Severity Hits 22.x, 24.x, 26.x

Node.js releases a HIGH severity security patch on June 17 for all active lines (22.x, ...

By ByteBot

June 14, 2026

Malicious npm and PyPI packages targeting Solana developers in the FakeFix supply chain attack campaign

Security

Solana FakeFix: 25 Malicious npm and PyPI Packages Steal Wallet Keys

25 malicious npm and PyPI packages target Solana developers in the FakeFix campaign — stealing ...

By ByteBot

June 12, 2026

JavaScript

npm v12 Breaking Changes: What Breaks in July 2026

npm v12 lands in July and breaks three things: install scripts, git deps, remote URLs. ...

By ByteBot

June 10, 2026

Miasma worm npm supply chain attack - Phantom Gyp binding.gyp technique bypassing package security

News

npm’s Phantom Gyp Worm Proves Signed Packages Aren’t Safe

The Miasma worm hit 57 npm packages in 5 days using a binding.gyp trick that ...

By ByteBot

June 8, 2026

Digital network visualization showing the Miasma supply chain worm propagating through Microsoft Azure GitHub repositories, with warning symbols and lock icons on a dark blue background

News

Miasma Worm Hits 73 Azure GitHub Repos — AI Agents Now Targeted

The Miasma supply chain worm disabled 73 Microsoft Azure GitHub repos in 105 seconds on ...

By ByteBot

June 7, 2026

News

node-redis 6.0: RESP3 Default and What to Do Now

node-redis 6.0 makes RESP3 the default protocol, bumps the Node.js minimum to 20, and adds ...

By ByteBot

June 5, 2026

12 3 4

Tag: npm

Posts navigation

Categories

Latest Posts