Hackernews posts about NPM

NPM is a package manager for JavaScript that allows developers to easily install and manage dependencies in their projects, serving as a central registry for millions of open-source packages.

1. Disrupting supply chain attacks on NPM and GitHub Actions (github.blog)
   90 points by nyku 23 days ago | 49 comments
2. NPM publish-time malware scanning and dual-use metadata (github.blog)
   8 points by smokeeaasd 23 days ago | discuss
3. NPM publish-time malware scanning and dual-use metadata (github.blog)
   5 points by Bobaso 23 days ago | 3 comments
4. NPM Packages in the Keyv and Cacheable Namespaces Compromised (socket.dev)
   5 points by tilt 16 days ago | 1 comments
5. GitHub shadowbanned an NPM package with 37M+ weekly downloads
   5 points by mattlue 20 days ago | 1 comments
6. North Korea-linked hackers targeted major NPM packages (aws.amazon.com)
   5 points by BlueBerry2001 22 days ago | discuss
7. NPM install is arbitrary code execution. We give it a disposable VM (mojave.sh)
   4 points by stwrt about 10 hours ago | 1 comments
8. ChainDrop worm crawls into NPM supply chain, evades standard defenses (www.theregister.com)
   4 points by sbulaev 6 days ago | discuss
9. NPM Left-Pad Incident (en.wikipedia.org)
   4 points by gherkinnn 7 days ago | discuss
10. NPM's keyv package got compromised having 127M weekly downloads (safedep.io)
    3 points by birdculture 16 days ago | 2 comments
11. GitHub Account Breach Fuels Shai-Hulud NPM Supply Chain Attack (www.esecurityplanet.com)
    3 points by doodlebugging 16 days ago | 1 comments
12. ChainDrop NPM supply-chain attack infects packages (www.bleepingcomputer.com)
    3 points by iLemming 16 days ago | 1 comments
13. Please add min-release-age to your .npmrc (www.endorlabs.com)
    3 points by scj13 16 days ago | 1 comments
14. The keyv worm ate 400 NPM packages in 90 minutes (installsafe.io)
    3 points by pmestha 2 days ago | discuss
15. ChainDrop worm crawls into NPM supply chain, evades standard defenses (www.theregister.com)
    3 points by Bender 3 days ago | discuss
16. Show HN: Sandbox the install step of any NPM package (www.npmjs.com)
    3 points by Myzura 6 days ago | discuss
17. Show HN: Day to day windows reminder CLI (NPM) (www.npmjs.com)
    3 points by jay__proto 9 days ago | discuss
18. Show HN: Sufleur - npm-style prompt registry with typed code-generation (github.com)
    3 points by wtomas 12 days ago | discuss
19. Show HN: I built a pg-migration-engine on NPM
    3 points by Vivek-KY 15 days ago | discuss
20. Worm compromises popular NPM packages (securitylabs.datadoghq.com)
    3 points by m-novikov 16 days ago | discuss
21. Shai Hulud campaign strikes NPM again (research.jfrog.com)
    3 points by cribwi 16 days ago | discuss
22. Bundlephobia – Find the cost of adding an NPM package to your bundle (bundlephobia.com)
    3 points by pastelsky 17 days ago | discuss
23. North Korea NullReceiver Hides Malware in NPM (opensourcemalware.com)
    2 points by 6mile 18 days ago | 1 comments
24. PkgDiet – Find unused, bloated, and unmaintained NPM packages and alternatives (www.npmjs.com)
    2 points by omtajne 3 days ago | discuss
25. Show HN: filebouncer - npm package for detecting suspicious uploads. (github.com)
    2 points by ramzi-abidi 11 days ago | discuss
26. ChainDrop: A Self-Propagating NPM Worm (unit42.paloaltonetworks.com)
    2 points by sss111 11 days ago | discuss
27. Making More NPM Packages Work with JsDelivr ESM Mode (www.jsdelivr.com)
    2 points by jimaek 11 days ago | discuss
28. I have disabled NPM publishing on all projects that have been affected (twitter.com)
    2 points by trelane 15 days ago | discuss
29. Shai-Hulud: What an NPM supply-chain hack reveals about the limits of provenance (ctolunchnyc.substack.com)
    2 points by polynomial 16 days ago | discuss
30. NPM Implements Pre-Publication Malware Scanning, but Will It Work? (opensourcemalware.com)
    2 points by jruohonen 21 days ago | discuss