Tag feed

#npm-security

7 posts0 followers

Explore Hashnode

Alternatives

JJebitoksharonjebitok.comMay 8 · 21 min read

Chain Reaction | Axios Attack (TryHackMe)

On March 31, 2026, two malicious versions of Axios — one of JavaScript's most downloaded HTTP client libraries — were quietly pushed to npm and downloaded by developers across the globe. What followed

0

AKAnup Karanjkarwowhow.hashnode.devMay 2 · 9 min read

The TeamPCP Attack: How One Stolen Token Compromised Trivy, LiteLLM, and 47 npm Packages — What Every Developer Must Do Now

On March 26, 2026, security researchers at Socket.dev flagged anomalous publishing activity across dozens of npm packages. Within hours, the scope of the incident became clear: a threat actor operating under the handle TeamPCP had compromised a singl...

0

Bbinaditbinadit.hashnode.devApr 7 · 6 min read

Supply chain security for dependencies

Securing your software supply chain: why dependency management is your biggest security blind spot Modern applications depend on hundreds or thousands of external packages, each representing code written by others but running with your application's ...

0

SRSatyam Rastogisatyamrastogi.hashnode.devFeb 20 · 5 min read

OpenClaw Supply Chain Attack: NPM Package Poisoning TTPs

Originally published on satyamrastogi.com Threat actors compromised Cline's NPM package v2.3.0, installing OpenClaw malware on 4,000+ systems. Analysis reveals sophisticated supply chain poisoning techniques and detection strategies for defenders. ...

0

ATArchibald Titanarchibaldtitan.hashnode.devFeb 17 · 4 min read

How to Protect Your Code Repository from Supply Chain Attacks in 2026

How to Protect Your Code Repository from Supply Chain Attacks in 2026 Supply chain attacks have become the most dangerous threat facing developers. In 2025 alone, over 700,000 malicious packages were detected across npm, PyPI, and other registries. T...

0

ATArchibald Titanarchibaldtitan.hashnode.devFeb 17 · 4 min read

How to Protect Your Code Repository from Supply Chain Attacks in 2026

How to Protect Your Code Repository from Supply Chain Attacks in 2026 Supply chain attacks have become the most dangerous threat facing developers. In 2025 alone, over 700,000 malicious packages were detected across npm, PyPI, and other registries. T...

0

HHongsaysomething.hashnode.devJun 2, 2025 · 3 min read

npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path Forward

The discovery of malicious npm packages like xlsx-to-json-lh—a six-year-old typosquatting artifact mimicking the legitimate xlsx-to-json-lc—alongside broader campaigns involving 60+ packages, underscores systemic vulnerabilities in npm's security mod...

0

#npm-security

Search Hashnode

#npm-security

Explore Hashnode

Chain Reaction | Axios Attack (TryHackMe)

The TeamPCP Attack: How One Stolen Token Compromised Trivy, LiteLLM, and 47 npm Packages — What Every Developer Must Do Now

Supply chain security for dependencies

OpenClaw Supply Chain Attack: NPM Package Poisoning TTPs

How to Protect Your Code Repository from Supply Chain Attacks in 2026

How to Protect Your Code Repository from Supply Chain Attacks in 2026

npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path Forward

Trending tags this week