npm

In November 2025, the npm ecosystem was hit by a flood of junk packages that were part of the IndonesianFoods malicious campaign. We’re breaking down the lessons learned from this incident.

Unknown attackers have compromised several popular npm packages in a supply-chain attack.

New malicious campaign hunts for Discord tokens and credit card information via infected npm packages.