npm

Evidence (10)

• 9The New Stack·8/7/2026security
  npm supply-chain attack hides malware behind provenance attestations

  Security researchers disclosed an npm supply-chain attack that compromised more than 400 packages, including projects tied to Keyv and Cacheable. The attackers used stolen maintainer credentials and lifecycle hooks to spread malware, showing that provenance attestations do not guarantee package integrity once a trusted workflow is compromised.

• 7InfoQ·8/7/2026security
  npm Adds Staged Publishing with Human Approval

  npm has introduced staged publishing, requiring maintainer approval before a package version becomes installable. The release process now includes a queued approval step with two-factor authentication, and the feature is available in npm CLI 11.15.0+ and Node.js 22.14.0+.

• 6Hacker News·8/6/2026research
  Users miss many threats when approving AI agent commands

  A browser game based on approving or denying AI coding agent commands collected data from more than 40,000 runs and 409,000 decisions. The results show players missed about one-third of threats on average, with familiar-looking commands such as npm run analyze often approved despite hidden malicious behavior in project scripts.

• 9Hacker News·8/4/2026security
  Keyv and related packages hit by active Shai-Hulud npm supply-chain attack

  Several npm packages, including Keyv-related modules, were reported compromised in an active supply-chain attack dubbed Shai-Hulud. The incident highlights the risk of malicious code spreading through widely used open-source dependencies and affecting downstream projects.

• 7Hacker News·7/30/2026product_launch
  CodePen launches CodePen 2.0

  CodePen has launched CodePen 2.0, describing it as a major rebuild with more work than the original product. The post highlights new workflows such as file-based JavaScript in Pens, npm package support via package.json, live collaboration, invites for co-editing, and adding MJML as a new block type. Early launch use cases included collaborative demos and building and deploying small sites directly from the editor.

• 8InfoQ·7/28/2026security
  GitHub hardens npm and Actions against supply chain attacks

  GitHub says it has rolled out several changes to disrupt common supply chain attack techniques targeting npm and GitHub Actions. The updates include temporary protection for high-impact npm accounts, safer defaults for actions/checkout, workflow trigger controls, and read-only cache access for untrusted Actions runs.

• 4Hacker News·7/23/2026open_source
  98.css brings Windows 98-style UI styling to the web

  98.css is a CSS-only design system for recreating the look of classic Windows 98 interfaces. It emphasizes semantic HTML and accessibility, and can be used with frameworks like React or plain JavaScript without adding any JavaScript of its own.

• 8The New Stack·7/1/2026security
  Codecov shows how CI pipelines can become the attack surface

  The article argues that the Codecov breach was not an isolated incident but an example of a broader pattern in which attackers target software build and deployment pipelines. It cites later supply-chain compromises such as XZ Utils and polyfill.io to show that CI/CD systems and other trusted delivery mechanisms can be used to exfiltrate secrets or deliver malware at scale.

• 7The New Stack·6/30/2026security
  Aikido buys Root to backport open source security fixes

  Aikido Security has acquired Root for $70 million and will fold its in-place vulnerability patching into a new product called Aikido Libraries. The company says it will also backport fixes for actively exploited vulnerabilities on CISA’s KEV list to open source projects for free across ecosystems including npm, PyPI, and Maven. The deal aims to reduce the gap between finding a vulnerability and fixing it without forcing immediate upgrades.

• 7OpenAI Blog·5/13/2026security
  OpenAI responds to TanStack npm supply chain attack

  OpenAI says it has responded to the TanStack "Mini Shai-Hulud" npm supply chain attack by securing systems and protecting signing certificates. The company also said macOS users must update OpenAI apps by June 12, 2026, as part of its mitigation steps against the incident.