Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.

OAKLAND, Calif.--(BUSINESS WIRE)--npm, Inc., which runs the world’s largest software registry and maintains the npm software package management application, today announced the acquisition of ^Lift ...

In light of recent cyberattacks and growing security concerns, GitHub is taking immediate and direct action to secure the open-source software supply chain.

OAKLAND, Calif.--(BUSINESS WIRE)--npm, Inc., which runs the world’s largest software registry and maintains the `npm` software development tool, today announced that the npm Registry has achieved one ...

Ten malicious packages mimicking legitimate software projects in the npm registry download an information-stealing component ...

The US government has issued new guidance for developers designed to improve the security of the software supply chain, and in so doing make the nation’s critical infrastructure more resilient. The ...

Supply chain security company Safety has discovered a trojan in NPM that masqueraded as Anthropic’s popular Claude Code AI ...

An advanced malware campaign on the npm registry steals the very keys that control enterprise cloud infrastructure.

Researchers continue to investigate a wave of malicious npm packages, with the published tally now reaching over 700. Last week, JFrog researchers disclosed the scheme in which an unknown threat actor ...