Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ...
Socket researchers discovered that the Bitwarden CLI was compromised as part of the ongoing Checkmarx supply chain campaign. The open source password manager serves more than 10 million users and over 50,000 businesses, and ranks among among the top three password managers by enterprise adoption. The affected package version appears to be @bitwarden/cli2026.4.0, and the malicious code was publishe
Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack - StepSecurity
It has been a week since the axios compromise, and we wanted to take some time to reflect. We published a detailed technical analysis during the incident and have been continuously updating it. But the human story, the frantic evening, the deleted GitHub issues, the community rallying together at midnight, that part hasn't been told yet. This is that story. axios is the most popular HTTP client in
axios Compromised on npm - Malicious Versions Drop Remote Access Trojan - StepSecurity
StepSecurity hosted a community town hall on this incident on April 1st at 10:00 AM PT - YouTube recording: https://youtu.be/3Hku_svFvos axios is the most popular JavaScript HTTP client library with over 100 million weekly downloads. On March 30, 2026, StepSecurity identified two malicious versions of the widely used axios HTTP client library published to npm: axios@1.14.1 and axios@0.30.4. The ma
Attackers Are Hunting High-Impact Node.js Maintainers in a C...
Since we published our initial analysis of the axios compromise, a deep dive into its hidden blast radius, and a report on the maintainer confirming it was social engineering, maintainers across the Node.js ecosystem have come out of the woodwork to report that they were targeted by the same social engineering campaign. The accounts now span some of the most widely depended-upon packages in the np
Release v20.0.0 · raineorshine/npm-check-updates
Auto Cooldown The cooldown option is now automatically applied from the respective package manager's config: npm - min-release-age (#1632) yarn - npmMinimalAgeGate (excluding npmPreapprovedPackages) (#1643) pnpm - minimumReleaseAge (excluding minimumReleaseAgeExclude) (#1639) Why is this a breaking change? If you use any of the above configs, npm-check-updates will automatically exclude releases t
npm bulk trusted publishing config and script security now generally available - GitHub Changelog
npm bulk trusted publishing config and script security now generally available Two new features are available today in npm CLI v11.10.0+: Bulk configuration for OIDC trusted publishing: Maintainers can now add or update trusted publishing configurations across multiple packages in a single operation using the npm trust command instead of configuring each package individually. New --allow-git flag
Introducing Phased Package Installations
Every time you run npm install, you're executing arbitrary code from potentially thousands of packages and package authors. "Install scripts" are run automatically, with full access to your system before you've even had a chance to review what's being installed. Unfortunately, this "download anything and run everything" model has been a security blind spot for years; that ends today. Today, we're
npm security update: Classic token creation disabled and granular token changes - GitHub Changelog
npm security update: Classic token creation disabled and granular token changes Editor’s note (November 5, 2025): We’ve updated this post to explicitly clarify that the affected tokens are npm tokens. Today marks another milestone in our ongoing effort to strengthen npm’s security. As previously announced, we’re implementing the first set of changes to npm’s token management system. Important: The
cleaning house in nx monorepo, how i removed 120 unused deps safely
cleaning house in nx monorepo, how i removed 120 unused deps safely Short version, I ran Knip across our Nx repo, took the “unused” list as a hint, deleted candidates, built, tested, booted apps, and put a few back when they were secretly used. Net, about 120 packages gone. Yarn install dropped by roughly a minute. Fewer CVE nags. Everyone slept better. the situationWe got a chunky Nx monorepo. Ro
Strengthening npm security: Important changes to authentication and token management - GitHub Changelog
Strengthening npm security: Important changes to authentication and token management As part of our ongoing commitment to securing the npm ecosystem, we’re implementing the first phase of security improvements outlined in our recent announcement. These changes will roll out over the coming five weeks completing by mid-November 2025 and require action from package maintainers. We’re taking this pha
Release v9.0.0 · lerna/lerna
9.0.0 (2025-09-23) Bug Fixes publish: ensure README file names are populated on package.json (#4211) (362875d) Features support OIDC trusted publishing (d51e344) OIDC trusted publishing is now supported by Lerna with no specification configuration required. A new guide has been added: https://lerna.js.org/docs/recipes/oidc-trusted-publishing A fully working example repo has been set up here https:
Our plan for a more secure npm supply chain
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Malicious Checkmarx Artifacts Found in Official KICS Docker ...
GitHub - flatt-security/setup-takumi-guard-npm: GitHub Action to configure npm with Takumi Guard registry auth via OIDC
npmx - Package Browser for the npm Registry
https://socket.dev/blog/npm-to-implement-staged-publishing
GitHub - danielroe/provenance-action: Fail CI when dependencies in your lockfile lose npm provenance or trusted publisher status
GitHub - bodadotsh/npm-security-best-practices: How to stay safe from NPM supply chain attacks
Introducing Socket Firewall: Free, Proactive Protection for Your Software Supply Chain
GitHub - antfu-collective/taze: 🥦 A modern cli tool that keeps your deps fresh
