npm
Latest stories covering npm, with summaries and links to related coverage.
2 articles · page 1 of 1
Connected topics
Keyv and friends compromised in active Shai-Hulud supply chain attack
news
7 min read
On August 4, 2026, attackers compromised the GitHub account of the maintainer of the Keyv library, which has approximately 127 million weekly npm downloads. The attackers injected a credential-stealing worm into Keyv and several other widely-used packages owned by the same maintainer, including Cacheable, Flat-cache, and File-entry-cache.
Axios compromised on NPM – Malicious versions drop remote access trojan
news
17 min read
Two malicious versions of the axios HTTP client library, axios@1.14.1 and axios@0.30.4, were published to npm using compromised credentials of a lead maintainer. The attacker altered the maintainer's email to a ProtonMail address and manually published the malicious packages, which included a remote access Trojan.