Tag
9 posts
A sophisticated worm just tore through 42 TanStack packages, compromising giants like OpenAI and Mistral AI. This wasn't a simple credential leak; it was a chained attack that rewrites the rules of open-source security.
The infamous Shai-Hulud worm has evolved, jumping from npm to the Go ecosystem. It's no longer hiding in your dependencies—it's weaponizing your VS Code and Claude configs to steal secrets the moment you open a project.
For years, a single `npm install` could unleash supply chain attacks on your machine. NPM 12 is finally slamming that door shut by killing automatic script execution by default.
Your open-source dependencies are a massive security risk, letting threats like the 'Shai-Hulud' worm invade your projects. A free, one-command tool can block these attacks before they even start.
NPM supply chain attacks are exploding, but a single setting can neutralize most of them. This 30-second fix delays new package installs, giving the community time to spot malware before it hits your machine.
Supply chain attacks are hitting Node.js projects weekly, but you can harden your setup in minutes. These battle-tested strategies for npm, pnpm, and Bun will stop most attacks before they start.
Deno 2.8 just dropped a bombshell on the Node.js world, fixing three of the most persistent developer headaches. Discover how your installs got 3.6x faster, security patches became automated, and publishing to npm is now a one-command job.
A simple `npm install` triggered a sophisticated attack, siphoning cloud secrets from SAP developers in just two hours. This is the story of the 'Mini Shai-Hulud' hack and why your projects are at risk.
A malicious version of the official Bitwarden CLI was published in a major supply chain attack, stealing developer secrets directly from their machines. This is how the Shai-Hulud attack works and why you need to act immediately.
