A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be ...

Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.

Researchers continue to investigate a wave of malicious npm packages, with the published tally now reaching over 700. Last week, JFrog researchers disclosed the scheme in which an unknown threat actor ...

A widely-adopted JavaScript library has been found carrying a critical vulnerability which could allow threat actors to ...

Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.

Two billion downloads per week. That’s the download totals for the NPM packages compromised in a supply-chain attack this week. Ninety-nine percent of the cloud depends on one of the packages, and one ...