The breach hit core JavaScript libraries such as chalk and strip-ansi, downloaded billions of times each week, raising alarms over the security of open-source software. Hackers have compromised widely ...

Security teams are grappling with a major supply chain attack on Axios, a popular JavaScript library with over 100 million ...

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Node-forge cryptography library flaw (CVE-2025-12816) allowed bypass of signature and certificate ...

A JavaScript library that scores over two million downloads every week has been injected with malicious code for stealing coins from a cryptocurrency wallet. The affected package is Event-Stream, ...

Up to four npm packages on Axios were replaced with malicious versions, in one of the most sophisticated supply chain attacks.

The React team published a fix on Dec. 3 and advises anyone using the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, to upgrade immediately. There has been a recent ...

A malicious actor used a compromised Ripple dev account to publish commits to NPM The commits would grant access to people's crypto wallets They were downloaded around 450 times before being pulled ...