npm

We’re breaking down why developers have moved into the crosshairs, the specific tactics attackers are using, and how to reduce the risks of company infrastructure being compromised.

In November 2025, the npm ecosystem was hit by a flood of junk packages that were part of the IndonesianFoods malicious campaign. We’re breaking down the lessons learned from this incident.

Unknown attackers have compromised several popular npm packages in a supply-chain attack.

New malicious campaign hunts for Discord tokens and credit card information via infected npm packages.