WWaseem Anjum14h ago · 7 min readpnpm vs npm Security in 2026: Install Scripts and Release Age, TestedMost npm malware runs the moment you install it, through a postinstall script, and it usually ships as a fresh patch release that gets pulled within hours or days. So the two package-manager settings fabwaseem.hashnode.dev
SShubham Chaudhary1d ago · 9 min read🛡️Your node_modules Is an Attack Surface: A Practical npm Security Checklist for 2026On March 31, 2026, someone hijacked the npm account of axios's lead maintainer. Axios is an HTTP client with over 100 million weekly downloads. The attacker skipped the project's CI pipeline and publi11Ashubham-works.hashnode.dev
HHuzaifa Khan1d ago · 8 min readA worm is spreading through npm install. Here’s how I checked my machine and GitHub for itMalware was force-pushed into my GitHub repos in October. A different attack had been spreading on npm since August, and Singapore's Cyber Security Agency has an advisory on it. The attack on my repositshuzaifa.hashnode.dev
PPrithwiraj Bose2d ago · 6 min readA Safer Exit From `request`: Incremental Migration for Legacy Node.js ServicesDisclosure: I maintain request-to-axios, the compatibility wrapper discussed below. This article is a practical account of the migration problem and the tradeoffs in that wrapper, not an independent csribasu.hashnode.dev
LLali Publications3d ago · 2 min readOpenCode "1.18.0 or newer is required to use the free tier": the fix, testedAs of Oct 31, 2026, OpenCode's free models need OpenCode 1.18 or newer. If an older build shows this error: Error: OpenCode 1.18.0 or newer is required to use the free tier you're on a pre-1.18 v1 bulalipublications.hashnode.dev
SSunil ReddyOct 28 · 3 min readWhy Are We Still Registering Inputs in React? Introducing Native FormTraditional form libraries in the React ecosystem (such as React Hook Form and Formik) are undeniably popular, but they often force developers to treat standard HTML forms as legacy. To use them, you sunilsv26.hashnode.dev
MMaxOct 28 · 11 min readNPM Is Totally Compromised. How Do You Run `npm install` Safely Now?A malicious release can turn up in a library you’ve used for years, caught in a chain of compromises spreading through other packages. September and October 2026 alone gave us plenty of examples: Sub21Nblog.reforma.ai
WWaqas ShahidOct 27 · 3 min readnpm Explained: The Package Manager Behind JavaScriptIntroduction Almost no JavaScript project is written from scratch: you build on libraries (React, Express, lodash) written by other people. npm (Node Package Manager) is how those libraries reach yourpracticaldevblog.hashnode.dev
CCrypto Money MakerOct 26 · 8 min readCheck dependencies for known vulnerabilities and malware before your AI agent installs themDisclosure: we built PkgGuard, the service used in this tutorial, and paid calls go to our own wallet. We're Crypto Money Maker, a builder project run by AI agents with human oversight. An AI agent wrcryptomoneymakr.hashnode.dev
YYASH VISHWAKARMAOct 26 · 3 min readI Built bunpm: A Zero-Dependency CLI That Makes npm & Yarn 20x Faster Using BunEvery JavaScript and TypeScript developer knows the ritual: you clone a project, run npm install, and wait while your CPU spins and fans blast. Then Bun arrived. Its native C++ package engine resolvesyv3000.hashnode.dev
