DEV Community

npm

Node Package Manager

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Glitchpack

Glitchpack

1
Comments
1 min read
I gave my coding agents a supply-chain tripwire (and a radar)

I gave my coding agents a supply-chain tripwire (and a radar)

Comments
3 min read
Typosquatting and Slopsquatting: Defending the Package Install Path

Typosquatting and Slopsquatting: Defending the Package Install Path

Comments
4 min read
New stricter rules from GitHub for code packages after security investigation

New stricter rules from GitHub for code packages after security investigation

Comments
2 min read
Your package.json Says What You Asked For. Only the Lockfile Says What You Got.

Your package.json Says What You Asked For. Only the Lockfile Says What You Got.

Comments
3 min read
Same hook, other side: how npm worms turned AI agent config into malware

Same hook, other side: how npm worms turned AI agent config into malware

Comments
12 min read
The Shai-Hulud Worm Now Steals Your AI Agent Credentials: A 20-Minute npm Audit

The Shai-Hulud Worm Now Steals Your AI Agent Credentials: A 20-Minute npm Audit

2
Comments
8 min read
Add CSV imports to a React app with column mapping and validation

Add CSV imports to a React app with column mapping and validation

1
Comments
3 min read
30,000 Machines Hacked by Fake Job Offers. Mine Was Almost Next.

30,000 Machines Hacked by Fake Job Offers. Mine Was Almost Next.

Comments 1
6 min read
Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.

Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.

Comments
3 min read
Our stylesheet was quietly restyling our users' apps. It took us weeks to notice.

Our stylesheet was quietly restyling our users' apps. It took us weeks to notice.

1
Comments
4 min read
AI Keeps Recommending Fake Packages. I Checked Which Ones Are Still Sitting Open.

AI Keeps Recommending Fake Packages. I Checked Which Ones Are Still Sitting Open.

Comments
7 min read
SKILL.md is the new package.json — and almost nobody scans it

SKILL.md is the new package.json — and almost nobody scans it

1
Comments
4 min read
620,000 Downloads Last Week for MCP Servers That Will Never Be Patched

620,000 Downloads Last Week for MCP Servers That Will Never Be Patched

Comments
3 min read
Building PackageGuard: Dependency Traversal, External APIs, and Explainable Risk Scoring in TypeScript

Building PackageGuard: Dependency Traversal, External APIs, and Explainable Risk Scoring in TypeScript

1
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.