Back to updates

Npm - 1

2026 (11)

June (5)

github: Dependabot no longer infers .npmrc

GitHub

2026-06-30

Dependabot no longer infers .npmrc settings for npm private registries. Instead of reconstructing .npmrc from lockfile URLs, it will stop trying to guess configuration based on potentially incorrect lockfile data.

github: npm adds preventive account protection for high-impact accounts

GitHub

2026-06-25

npm now applies a temporary preventive safeguard to high-impact accounts when it detects sensitive account changes. The measure is intended to reduce account-takeover risk for maintainers of widely used packages.

security: From package to postinstall payload: Inside the Mastra npm supply chain compromise

Microsoft Security Blog

2026-06-18

Microsoft describes a compromised npm package in the Mastra ecosystem that spread a hidden postinstall payload to 140+ projects. The post focuses on detection, hunting, and defense guidance using Microsoft Defender and threat intelligence.

github: Upcoming breaking changes for npm v12

GitHub

2026-06-09

npm v12 will change the default behavior of `npm install` with security-related defaults. The post says these changes are already available as warnings in npm 11.16.0 and newer.

security: Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

Microsoft Security Blog

2026-06-03

Microsoft reports a large-scale npm supply chain attack affecting over 90 versions of @redhat-cloud-services packages. The malicious code targets CI/CD and developer systems to steal GitHub, cloud, and local credentials, and propagates by republishing trusted packages.

May (4)

security: Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Security Blog

2026-05-30

Microsoft reports a dependency confusion campaign using 33 malicious npm packages to collect reconnaissance data from developer and build environments. The post outlines the attack chain, attacker tradecraft, and detection opportunities for identifying related activity.

security: Typosquatted npm packages used to steal cloud and CI/CD secrets

Microsoft Security Blog

2026-05-29

Microsoft describes the Mini Shai-Hulud campaign, where malicious typosquatted npm packages were used to steal cloud and CI/CD credentials from developer environments. The post outlines the attack chain, detection opportunities, and mitigation guidance.

github: Staged publishing and new install-time controls for npm

GitHub

2026-05-22

GitHub announced two npm supply-chain security updates: staged publishing is now generally available, and npm install gets new source अनुमति flags for file, remote, and directory dependencies. These new flags extend the existing --allow-git control.

security: Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

Microsoft Security Blog

2026-05-20

Microsoft reports that compromised @antv npm packages were used to deploy the Mini Shai-Hulud payload, which runs during npm install and steals CI/CD secrets from Linux-based automation environments. The malware targets credentials from GitHub, AWS, Kubernetes, Vault, npm, and 1Password.

April (2)

github: npm trusted publishing now supports CircleCI

GitHub

2026-04-07

npm trusted publishing now supports CircleCI as an OIDC provider for publishing packages to npm. Maintainers can authenticate from CircleCI workflows without stored credentials, alongside existing support for GitHub Actions and GitLab CI/CD.

security: Mitigating the Axios npm supply chain compromise

Microsoft Security Blog

2026-04-01

Microsoft reports that Axios was compromised in a March 31, 2026 npm supply chain attack. Two newly published version-update packages were used to download from command-and-control infrastructure, which Microsoft Threat Intelligence attributes to the North Korean actor Sapphire Sleet.