» Tag
npm
15 postsShai-Hulud npm Worm Infects Over 1,280 Packages
Shai-Hulud npm worm spread credential-stealing malware across over 1,280 packages.
How a hijacked npm preinstall hook delivered a silent infostealer
A hijacked npm package used a preinstall hook to drop a cross-platform Rust infostealer, exposing risks in unattended and AI-agent-driven installs.
Node.js: The Runtime That Changed Backend Development
A deep look at Node.js's non-blocking event loop, the npm ecosystem, and how it solved the C10K problem — plus when to use it and when to avoid it.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comChainDrop worm crawls into npm supply chain, evades standard defenses
ChainDrop, a Shai-Hulud npm worm variant, infected 444 packages and spreads via tarballs, evading standard repository-based defenses.
Maestro AI: A Router That Stops Overpaying for LLM Calls
Maestro AI routes each LLM call in Cursor and Claude Code to the cheapest capable model, escalating to premium tiers only when task complexity demands it.
Software Registries Are Becoming Trust Infrastructure, Not Catalogs
npm, PyPI, and crates.io are adopting trusted publishing against supply chain attacks, but identity checks alone can't guarantee safety.
Why warm npm installs are slow: materializing 1M files, not downloading
Why warm npm/yarn installs stay slow: materializing ~1M files, not fetching, is the bottleneck. A clonefile-based fix cuts install time 5x.
AsyncAPI Supply Chain Attack Delivers Miasma RAT via NPM
A supply chain attack on AsyncAPI has resulted in malicious npm packages delivering Miasma RAT. This incident reveals critical vulnerabilities.
Cybersecurity Startup Published Infostealers to NPM
Seven NPM packages typosquatting Anthropic, OpenAI, LangChain and Vercel used postinstall scripts to exfiltrate git, SSH and cloud identity data. The publisher traces back to an Israeli security startup founder.
Zero-Dependency Streaming Tar Parser and Writer for JavaScript
modern-tar is a fast, lightweight TAR parser for JavaScript with zero dependencies.