GIGAZINE

The era of simply running 'npm install' to execute code is coming to an end, as npm plans to disable automated script execution by default.

The JavaScript package management tool 'npm' is scheduled to implement a change in its 'npm v12' release, which is expected in July 2026. This change will prevent the script that is automatically ...
The Hacker News

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

Malicious npm package indexed-btree hid its loader in runtime code, avoiding install hooks after logging millions of downloads.

Will AI agents repeat the lessons npm learned over a decade?

How many people actually look at the contents of a package before running `npm install`?Most people just look at the name and ...
Cyber Security Intelligence

Malware Bypasses npm's Install Script Defences

Researchers find attackers now infect widely used package at runtime, sidestepping recent lifecycle-script restrictions entirely. chaeckmarx ## A New Evasion Technique Emerges ...
Ars Technica

Hundreds of code libraries posted to NPM try to install malware on dev machines

An ongoing attack is uploading hundreds of malicious packages to the open source node package manager (NPM) repository in an attempt to infect the devices of developers who rely on code libraries ...
CSOonline

NPM JavaScript registry suffers massive influx of malware, report says

The NPM JavaScript registry has experienced a jump in malware, including packages related to data theft, crypto mining, botnets, and remote code execution, according to security company WhiteSource.