DEV Community

npm

Node Package Manager

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole

OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole

Comments
15 min read
I made an interactive Sakura tree that runs in your browser, and you can add it to your own website with npm. Its about 16 KB 🌸

I made an interactive Sakura tree that runs in your browser, and you can add it to your own website with npm. Its about 16 KB 🌸

1
Comments
1 min read
Two Worms, One Blind Spot

Two Worms, One Blind Spot

Comments
3 min read
Is this project npm, pnpm, Yarn 1 or Yarn 4? How to tell, and why Yarn is the tricky one

Is this project npm, pnpm, Yarn 1 or Yarn 4? How to tell, and why Yarn is the tricky one

Comments
4 min read
pnpm vs npm Security in 2026: Install Scripts and Release Age, Tested

pnpm vs npm Security in 2026: Install Scripts and Release Age, Tested

1
Comments
6 min read
10 TypeScript files, 5 SDK artefacts: typed in Node and Deno

10 TypeScript files, 5 SDK artefacts: typed in Node and Deno

Comments
5 min read
Your Coding Agent Added an npm Package. 6 Commands to Vet It Before You Land the Branch

Your Coding Agent Added an npm Package. 6 Commands to Vet It Before You Land the Branch

1
Comments
8 min read
Securing your pnpm supply chain

Securing your pnpm supply chain

Comments
2 min read
The Nx Malware Ran Claude Code With --dangerously-skip-permissions. Could It on Yours?

The Nx Malware Ran Claude Code With --dangerously-skip-permissions. Could It on Yours?

Comments
8 min read
I Found a Fourth Package Registry My Sandbox Could Reach. It Checksums Every File, Not Just the Tarball.

I Found a Fourth Package Registry My Sandbox Could Reach. It Checksums Every File, Not Just the Tarball.

Comments
6 min read
I Publish npm Packages With No Tokens Stored Anywhere — Here's the Setup

I Publish npm Packages With No Tokens Stored Anywhere — Here's the Setup

Comments
4 min read
Introducing @zervonex/baileys - A Tailored Fork of the Baileys WhatsApp Web API

Introducing @zervonex/baileys - A Tailored Fork of the Baileys WhatsApp Web API

Comments
2 min read
Check that a package exists before your AI agent installs it

Check that a package exists before your AI agent installs it

Comments
2 min read
Dangerous package 'imgdecode' downloaded 979 times from npm library

Dangerous package 'imgdecode' downloaded 979 times from npm library

Comments
2 min read
The Tensorlake Worm Commits a .claude Folder So It Runs Again When You Open Claude Code

The Tensorlake Worm Commits a .claude Folder So It Runs Again When You Open Claude Code

Comments
10 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.