An apparent "Dune" aficionado is responsible for perpetrating the first self-propagating attack on the npm JavaScript repository in what a security company has described as being one of the most ...

Red Hat hit by npm supply‑chain attack - here's how to stay safe ...

TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious versions anyway. The CI/CD Trust-Chain Audit Grid maps the six gaps it ...

July 2026, blocking install scripts, Git dependencies, and remote URL sources by default. Every team running npm install in ...