Here's how the JavaScript Registry evolves makes building, sharing, and using JavaScript packages simpler and more secure ...

First, people need to remember that the original attack on tools like ChalkJS was a successful MFA phishing attempt on npm’s ...

Compromised dYdX npm and PyPI packages delivered wallet-stealing malware and a RAT via poisoned updates in a software supply chain attack.

Operation Dream Job is evolving once again, and now comes through malicious dependencies on bare-bones projects.

JavaScript projects should use modern tools like Node.js, AI tools, and TypeScript to align with industry trends.Building ...

Free beer is great. Securing the keg costs money fosdem 2026 Open source registries are in financial peril, a co-founder of ...

TypeScript 6.0 is intended to be the last release based on the current JavaScript codebase, before a Go-based compiler and language service debuts in TypeScript 7.0.

网络安全研究人员发现了一系列与朝鲜Lazarus组织相关的恶意软件包，分布在npm和PyPI仓库中。该活动代号为graphalgo，自2025年5月起活跃。攻击者通过LinkedIn、Facebook等社交平台或Reddit论坛的虚假招聘接触开发者，创建区块链公司Veltrix Capital作为掩护。恶意包通过依赖项间接植入，部署远程访问木马收集系统信息。研究还发现了其他恶意npm包活动，包括B ...

A new variation of the fake recruiter campaign from North Korean threat actors is targeting JavaScript and Python developers ...

这一警告来自Koi Security的Oren Yomtov，他在周一的博客中披露了在多个包管理器中发现的六个零日漏洞，这些漏洞可能允许黑客绕过去年11月Shai-Hulud攻击npm并破坏超过700个包后推荐的防护措施。

Open source packages published on the npm and PyPI repositories were laced with code that stole wallet credentials from dYdX developers and backend systems and, in some cases, backdoored devices, ...

Researchers have revealed that bad actors are targeting dYdX and using malicious packages to empty its user wallets.