npm | byteiota

Tag: npm

PyPI padlock securing a Python package with 14-day calendar restriction

Cloud & DevOps

PyPI Locks Old Releases After 14 Days: Migrate Now

PyPI now rejects new file uploads to releases older than 14 days. Here is what ...

By ByteBot

July 30, 2026

Cloud & DevOps

AsyncAPI npm Backdoor: –ignore-scripts Won’t Save You

AsyncAPI npm packages backdoored via the project's own CI pipeline on July 14. Import-time malware ...

By ByteBot

July 22, 2026

A terminal showing a package install blocked by a security shield, representing Refuse pre-install CVE blocking for AI coding agents

AI & Development

Refuse: Block Vulnerable Package Installs Before Your AI Agent Ships Them

Refuse is a pre-install package manager shim that blocks vulnerable installs across npm, pip, cargo, ...

By ByteBot

July 20, 2026

ViteVenom malicious npm packages using blockchain C2 infrastructure to deliver remote access trojans targeting Vite developers

JavaScript

ViteVenom: 7 Fake npm Packages Use Blockchain to Deliver RATs

Seven malicious npm packages impersonating @vitejs/* deliver a RAT via blockchain C2 — infrastructure that ...

By ByteBot

July 19, 2026

npm v12 install scripts blocked by default - supply chain security migration guide

JavaScript

npm v12: Install Scripts Blocked by Default — Migration Guide

npm v12 shipped July 8 and disabled install scripts by default. Here’s what breaks, why ...

By ByteBot

July 17, 2026

Open Source

Refuse: Block Vulnerable Package Installs Before Your AI Agent Does

Refuse is an open-source shim that intercepts npm, pip, cargo, and 15 more package managers ...

By ByteBot

July 13, 2026

npm package backdoor supply chain attack illustration with blue circuit board and cracked lock on dark background

Security

jscrambler npm Backdoored: Rotate Your Credentials Now

The jscrambler npm package was backdoored five times on July 11, 2026. Five malicious versions ...

By ByteBot

July 13, 2026

Shield protecting a web framework node diagram representing Hono security patch CVE-2026-59895 CVE-2026-59896 CVE-2026-59897

News

Hono 4.12.27 Patches Three CVEs: Upgrade Now

Hono 4.12.27 patches three CVEs: XSS via cx() in hono/css, async context leakage in hono/jsx, ...

By ByteBot

July 13, 2026

Security

npm 12 Is Live: Install Scripts Off and 2FA Tokens Expiring

npm v12 shipped July 8 disabling install scripts by default. CI exits green while native ...

By ByteBot

July 11, 2026

AI coding agent connected to package registries with a warning shield blocking vulnerable package installs

News

AI Coding Agents Skip Package Verification — And Three Tools Just Dropped to Fix It

AI coding agents install packages without safety checks. Three tools shipped in 2026 to close ...

By ByteBot

July 5, 2026

123...6

Tag: npm

Posts navigation

Categories

Latest Posts