npm

npm is a package manager for the JavaScript programming language, providing a registry for developers to share and reuse code packages.

Why it’s in the news: It is in the news due to a series of malware campaigns that have exploited its platform to distribute malicious code to developers.

Latest on npm

• Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
• Malicious B-tree NPM Package Accumulates Millions of Downloads
• New npm malware finds a way around install script defenses
• Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
• JavaScript installer pnpm recast in Rust because ECMAScript can't keep up
• ChainDrop worm crawls into npm supply chain, evades standard defenses
• By midday, security firm Aikido counted at least 868 compromised packages across 1,381 versions, together carrying over two billion monthly installs, a total still climbing.
• supply chain attack aimed at stealing authentication credentials from the npm ecosystem

Connections

3 entities linked to npm across the news graph.