Vulnerabilities
Prevent npm Package Vulnerabilities: Prioritized Defense Measures
Supply chain attacks bypass perimeter defenses by embedding malicious code in trusted dependencies that pass standard integrity checks and signature verification.
npm security
Everything Threat Times has reported about npm security: 2 stories, newest first. Part of our Vulnerabilities coverage.
Malware & Ransomware
Mistakes That Let Malicious npm Packages Compromise Your Build
Dependency confusion and typosquatting exploit default trust in public registries, allowing attackers to inject code into your build pipeline without direct access to your source repository.