--- title: "#npm-security articles | Hashnode" description: "Explore 7 articles tagged #npm-security on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/npm-security" --- Tag # #npm-security 7 posts · 0 followers [Jebitok](https://hashnode.com/@w1t3r) · [May 8](https://hashnode.com/posts/chain-reaction-axios-attack-tryhackme/69fdb8e46fb09594bd364990) ### [Chain Reaction | Axios Attack (TryHackMe)](https://www.sharonjebitok.com/chain-reaction-axios-attack-tryhackme?utm_source=hashnode&utm_medium=feed) On March 31, 2026, two malicious versions of Axios — one of JavaScript's most downloaded HTTP client libraries — were quietly pushed to npm and downloaded by developers across the globe. What followed 21 min read · [sharonjebitok.com](https://www.sharonjebitok.com/chain-reaction-axios-attack-tryhackme?utm_source=hashnode&utm_medium=feed) [Anup Karanjkar](https://hashnode.com/@anupkaranjkar) · [May 2](https://hashnode.com/posts/teampcp-supply-chain-attack-trivy-litellm-npm-2026/69f58316f7658b1181b4db76) ### [The TeamPCP Attack: How One Stolen Token Compromised Trivy, LiteLLM, and 47 npm Packages — What Every Developer Must Do Now](https://wowhow.hashnode.dev/teampcp-supply-chain-attack-trivy-litellm-npm-2026?utm_source=hashnode&utm_medium=feed) The TeamPCP supply chain attack compromised Trivy, LiteLLM, and 47 npm packages via a stolen token. Full timeline, detection commands, and CI/CD hardening steps. 9 min read · [wowhow.hashnode.dev](https://wowhow.hashnode.dev/teampcp-supply-chain-attack-trivy-litellm-npm-2026?utm_source=hashnode&utm_medium=feed) [binadit](https://hashnode.com/@binadit) · [Apr 7](https://hashnode.com/posts/supply-chain-security-for-dependencies/69d4b5acb82d5cd78ffa5601) ### [Supply chain security for dependencies](https://binadit.hashnode.dev/supply-chain-security-for-dependencies?utm_source=hashnode&utm_medium=feed) Securing your software supply chain: why dependency management is your biggest security blind spot Modern applications depend on hundreds or thousands of external packages, each representing code written by others but running with your application's ... 6 min read · [binadit.hashnode.dev](https://binadit.hashnode.dev/supply-chain-security-for-dependencies?utm_source=hashnode&utm_medium=feed) [Satyam Rastogi](https://hashnode.com/@satyamrastogi) · [Feb 20](https://hashnode.com/posts/openclaw-supply-chain-attack-npm-package-poisoning-ttps/6998686be70ed17e792c6545) ### [OpenClaw Supply Chain Attack: NPM Package Poisoning TTPs](https://satyamrastogi.hashnode.dev/openclaw-supply-chain-attack-npm-package-poisoning-ttps?utm_source=hashnode&utm_medium=feed) Originally published on satyamrastogi.com Threat actors compromised Cline's NPM package v2.3.0, installing OpenClaw malware on 4,000+ systems. Analysis reveals sophisticated supply chain poisoning techniques and detection strategies for defenders. ... 5 min read · [satyamrastogi.hashnode.dev](https://satyamrastogi.hashnode.dev/openclaw-supply-chain-attack-npm-package-poisoning-ttps?utm_source=hashnode&utm_medium=feed) [Archibald Titan](https://hashnode.com/@archibaldtitan) · [Feb 17](https://hashnode.com/posts/how-to-protect-your-code-repository-from-supply-chain-attacks-in-2026-1/6994125b8dcb21caa04194cc) ### [How to Protect Your Code Repository from Supply Chain Attacks in 2026](https://archibaldtitan.hashnode.dev/how-to-protect-your-code-repository-from-supply-chain-attacks-in-2026-1?utm_source=hashnode&utm_medium=feed) Supply chain attacks are the #1 threat to developers. Learn how to protect your code repository with practical security measures. 4 min read · [archibaldtitan.hashnode.dev](https://archibaldtitan.hashnode.dev/how-to-protect-your-code-repository-from-supply-chain-attacks-in-2026-1?utm_source=hashnode&utm_medium=feed) [Archibald Titan](https://hashnode.com/@archibaldtitan) · [Feb 17](https://hashnode.com/posts/how-to-protect-your-code-repository-from-supply-chain-attacks-in-2026/699412340208547d5ef6d644) ### [How to Protect Your Code Repository from Supply Chain Attacks in 2026](https://archibaldtitan.hashnode.dev/how-to-protect-your-code-repository-from-supply-chain-attacks-in-2026?utm_source=hashnode&utm_medium=feed) Supply chain attacks are the #1 threat to developers. Learn how to protect your code repository with practical security measures. 4 min read · [archibaldtitan.hashnode.dev](https://archibaldtitan.hashnode.dev/how-to-protect-your-code-repository-from-supply-chain-attacks-in-2026?utm_source=hashnode&utm_medium=feed) [Hong](https://hashnode.com/@hongster) · [Jun 2, 2025](https://hashnode.com/posts/npms-security-dilemma-how-malicious-packages-exploit-openness-and-the-path-forward/683d33db26a8e807e89db00f) ### [npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path Forward](https://saysomething.hashnode.dev/npms-security-dilemma-how-malicious-packages-exploit-openness-and-the-path-forward?utm_source=hashnode&utm_medium=feed) The discovery of malicious npm packages like xlsx-to-json-lh—a six-year-old typosquatting artifact mimicking the legitimate xlsx-to-json-lc—alongside broader campaigns involving 60+ packages, underscores systemic vulnerabilities in npm's security mod... 3 min read · [saysomething.hashnode.dev](https://saysomething.hashnode.dev/npms-security-dilemma-how-malicious-packages-exploit-openness-and-the-path-forward?utm_source=hashnode&utm_medium=feed)