Attacks on the NX build system and React packages highlight escalating threats to enterprise software development pipelines.

Npm (Node.js Package Manager) devs say the npm command-line interface (CLI) client is impacted by a security bug -- a combination between a file traversal and an arbitrary file (over)write issue.

This window has been initialized for using Node.js and NPM so that you can run your commands from this window. To verify, just run ‘npm –v’ to see the version of NPM installed on your computer.

After last week a popular JavaScript library started showing full-blown ads in the npm command-line interface, npm, Inc., the company that runs the npm tool and website, has taken a stance and ...

Nx is the latest target of a software supply chain attack in the NPM ecosystem, with multiple malicious versions being ...

That veneer of credibility helps this threat actor to convince Solana devs to implement packages called “solana-pump-test” ...

Package manifests in the npm registry are not validated against metadata files in the package itself, leaving the door open for attackers.

npm, Inc. has announced the release of the npm@6 package manager, which will feature new security enhancements.