---
title: "Discussion on \"npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path Forward\" | Hashnode"
description: "Discussion on \"npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path Forward\". The discovery of malicious npm packages like xlsx-to-json-lh—a six-year-old typosquatting artifact mimicking the legitimate xlsx-to-json-lc—alongside broader campaigns involving 60+ packages, underscores systemic vulnerabilities in npm's security mod..."
url: "https://hashnode.com/posts/npms-security-dilemma-how-malicious-packages-exploit-openness-and-the-path-forward/683d33db26a8e807e89db00f"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path Forward](https://saysomething.hashnode.dev/npms-security-dilemma-how-malicious-packages-exploit-openness-and-the-path-forward?utm_source=hashnode&utm_medium=feed)

The discovery of malicious npm packages like xlsx-to-json-lh—a six-year-old typosquatting artifact mimicking the legitimate xlsx-to-json-lc—alongside broader campaigns involving 60+ packages, underscores systemic vulnerabilities in npm's security mod...

Jun 2, 2025 · 3 min read · saysomething.hashnode.dev  
Read the article

-   [#npm-security](https://hashnode.com/tag/npm-security)
-   [#typosquatting](https://hashnode.com/tag/typosquatting)
-   [#open-source-ecosystem](https://hashnode.com/tag/open-source-ecosystem)
-   [#dependency-risks](https://hashnode.com/tag/dependency-risks)
-   [#supply-chain-attacks](https://hashnode.com/tag/supply-chain-attacks)

## Written by

[Hong](https://hashnode.com/@hongster)

@hongster · Johor Bahru, Malaysia

  
[View profile](https://hashnode.com/@hongster)

Script Monkey @ Innoractive

I work with Linux in the day, ballroom dancing at night. I use Arch, btw.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.