11 articles tagged
Cloudflare published @cloudflare/vitest-plugin 1.0.0 to npm on 20 August 2026 and called the API unchanged. Outbound request mocking now needs msw 2.14 and a 0.0.1 package with no licence file.
Stripe's npm beta dist-tag has pointed at 18.6.0-alpha.2 since 17 September 2025. It sits four majors behind 22.5.0, carries the alpha suffix Stripe reserves for private preview, and 18.6.0 never shipped.
Cloudflare Gateway can now allow or block package downloads across seven ecosystems. Detection is fail-open, and an unparseable version string matches no comparison at all.
The Cloudflare Workers Vitest package became @cloudflare/vitest-plugin 1.0.0 on 20 August 2026. The rename is real, the API is unchanged, and the documented find-and-replace targets a version shipped in May.
On 4 August 2026 a worm published poisoned versions of keyv and cacheable carrying valid npm provenance. Rotating credentials first triggers a dead-man's switch. Nine controls for Node-heavy teams, and what npm v12 does
Valid provenance signed keyv 6.0.0 on 4 August 2026, and eight malicious releases were still tagged latest 101 minutes later. What attestations prove, and the cooldown config for npm, pnpm, Yarn and Bun.
A hijacked maintainer account pushed Shai-Hulud malware into the keyv and cacheable npm family on 4 August 2026, with valid GitHub Actions provenance. Here is the containment order for the first 90 minutes.
On 28 July 2026 GitHub began ingesting OpenSSF malicious-packages advisories, so Dependabot malware alerts now cover npm, PyPI and more. Here is how to enable them and respond when one fires.
In July 2026 attackers poisoned jscrambler and AsyncAPI npm packages; the AsyncAPI payload ran at import time, past install-script defenses. How to secure your software supply chain, with a checklist and comparison
TanStack's release pipeline authenticated 84 malicious npm versions in six minutes using a valid OIDC token. No token was stolen. Here is the chain, and the controls that close it as of July 2026.
npm 12 is generally available and tagged latest. Lifecycle scripts, git dependencies and remote tarballs are now opt-in, node-gyp builds are blocked, and the failure shows up in CI first. Here is the migration.
