GitHub, which owns the npm registry for JavaScript packages, says it is tightening security in response to recent attacks.

GitHub is introducing a set of defenses against supply-chain attacks on the platform that led to multiple large-scale ...

GitHub enforces FIDO 2FA and seven-day token limits after Shai-Hulud npm attack to boost supply chain security.

"Each published package becomes a new distribution vector: as soon as someone installs it, the worm executes, replicates, and ...

A Dune-inspired worm recently hit CrowdStrike and npm, infecting hundreds of packages. Here's what happened - and how to protect your code.

Dozens of npm libraries, including a color library with over 2 million downloads a week, have been replaced with novel ...

Reports surfaced that the widely used npm package @ctrl/tinycolor had been compromised by Wormable Malware as part of a ...

Cybercriminals use fake troubleshooting websites to trick Mac users into running terminal commands that install Shamos malware through ClickFix tactics.

In response to the recent supply chain attack in the JavaScript package manager npm, GitHub has made a few changes that will ...

A new self-replicating worm dubbed Shai-Hulud has compromised over 180 npm packages, stealing credentials and spreading ...

A decade-long RubyGems maintainer, Ellen Davis (also known as duckinator), has resigned from Ruby Central following what she ...

A new supply chain attack on npm, the node package manager, has injected the first malware with self-replicating worm ...