NPM
15 mentions across all digests
npm is the JavaScript package registry and package manager with 100 million weekly downloads that was the target of a March 2026 supply chain attack compromising the widely used axios package with a remote access trojan.
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI's npm package was poisoned through a compromised GitHub Action in a supply chain attack affecting 10M+ users, with the malicious code sharing infrastructure with other Checkmarx campaign tools.
Anthropic goes nude, exposes Claude Code source by accident
Anthropic accidentally exposed Claude Code's complete source (~1,900 TypeScript files, 512K+ LOC) through an unobfuscated npm source map, which was mirrored across 41,500+ GitHub forks before removal.
Before GitHub
Armin Ronacher questions GitHub's future under Microsoft stewardship, tracing how it transformed open source but accidentally enabled the micro-dependency explosion and may be superseded.
Npm Slop & Wonky Software Supply Chains
npm and pip registries lack provenance verification for uploaded bundles, creating exploitable supply chain vulnerabilities that source-reproducible builds cannot practically mitigate.
Features everyone should steal from npmx
npmx's viral adoption (1,000+ PRs, 100+ contributors in weeks) forced npm to finally ship dark mode—a 5-year-old request—and adopt UX patterns like dependency vulnerability trees and version diffing.
At least one major package registry (npm, PyPI, VS Code Marketplace, or Chrome Web Store) will announce new policies specifically targeting malicious acquisitions of legitimate packages/extensions — requiring ownership transfer review or mandatory re-audit — by end of May 2026, citing the Essential Plugin WordPress backdoor as precedent.
npm will announce mandatory provenance attestation, package signing, or enhanced 2FA requirements for packages exceeding 50K weekly downloads by end of June 2026, following the JavaScript AI toolchain supply chain attack cluster targeting NPM/Axios/plain-crypto-js.