DEV Community

npm

Node Package Manager

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
The Shai-Hulud Worm Now Steals Your AI Agent Credentials: A 20-Minute npm Audit

The Shai-Hulud Worm Now Steals Your AI Agent Credentials: A 20-Minute npm Audit

2
Comments
8 min read
How to set up a private npm registry: from install to .npmrc, scope, and publish

How to set up a private npm registry: from install to .npmrc, scope, and publish

1
Comments
6 min read
Add CSV imports to a React app with column mapping and validation

Add CSV imports to a React app with column mapping and validation

1
Comments
3 min read
30,000 Machines Hacked by Fake Job Offers. Mine Was Almost Next.

30,000 Machines Hacked by Fake Job Offers. Mine Was Almost Next.

Comments 1
6 min read
Publish a public artifact portal: anonymous /explore install commands

Publish a public artifact portal: anonymous /explore install commands

2
Comments
4 min read
I counted the strangers inside famous npm dependency trees

I counted the strangers inside famous npm dependency trees

Comments
2 min read
Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.

Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.

Comments
3 min read
Our stylesheet was quietly restyling our users' apps. It took us weeks to notice.

Our stylesheet was quietly restyling our users' apps. It took us weeks to notice.

1
Comments
4 min read
AI Keeps Recommending Fake Packages. I Checked Which Ones Are Still Sitting Open.

AI Keeps Recommending Fake Packages. I Checked Which Ones Are Still Sitting Open.

Comments
7 min read
The One-Line Package That Broke create-react-app

The One-Line Package That Broke create-react-app

3
Comments 2
5 min read
Building PackageGuard: Dependency Traversal, External APIs, and Explainable Risk Scoring in TypeScript

Building PackageGuard: Dependency Traversal, External APIs, and Explainable Risk Scoring in TypeScript

1
Comments
5 min read
MemTensor: When an AI Memory Plugin Becomes the Credential Collector

MemTensor: When an AI Memory Plugin Becomes the Credential Collector

Comments
2 min read
The npm Worm Era: Why Package Signatures Did Not Stop Shai-Hulud

The npm Worm Era: Why Package Signatures Did Not Stop Shai-Hulud

Comments
3 min read
I made string-range-tokens (srTokens) — here’s what to use it for

I made string-range-tokens (srTokens) — here’s what to use it for

Comments
4 min read
Fix: @prisma/client did not initialize yet (Prisma 6 and 7)

Fix: @prisma/client did not initialize yet (Prisma 6 and 7)

Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.