#npm

Nodeup is a new tool that automates Node.js version upgrades and NPM package migrations, helping developers streamline dependency updates and version transitions in their projects.

Mtg-crucible is an NPM package that renders custom Magic: The Gathering cards from structured or text descriptions into output images, usable both server-side and client-side.

The article introduces staged publishing, a new NPM security feature that allows package maintainers to publish updates in phases, reducing the risk of supply-chain attacks by enabling community review before full rollout.

DepGuard is a new tool that helps developers visualize and simulate the blast radius of vulnerabilities in NPM dependencies, enabling better risk assessment and security management for JavaScript projects.

A user on Hacker News reports that npm packages @esbuild-kit/core-utils and @esbuild-kit/esm-loader display deprecation warnings pointing to the domain tsx.is, which appears to be a hijacked attacker site generating revenue from visits. The user is uncertain whether the tsx.is domain or the npm packages themselves have been compromised.

NPM has introduced preventive account protection for high-impact accounts, aimed at enhancing security by proactively safeguarding these accounts from unauthorized access and potential compromises.

Drizzle ORM was unable to publish new versions to NPM for a month because its packument (package metadata) exceeded NPM's size limits, caused by automatically generated TypeScript declaration files bloating the manifest. The issue highlights how large packuments can silently block package updates on NPM.

Supabase has introduced security measures to protect projects from NPM supply chain attacks, including package verification, dependency auditing, and recommendations for using lock files and private registries to mitigate risks.

TanStack suffered an NPM supply chain attack on February 13, 2025, when an attacker gained access to the @tanstack/eslint-plugin-query package. The attacker published malicious versions (1.0.0–1.0.4) containing ransomware that encrypted local files and demanded a ransom. Grafana Labs' post-incident review details the attack timeline, impact, and lessons for securing open-source supply chains.

Projectlens v1.0.6 has been released, adding support for npkill. The package helps manage Node.js projects by locating and removing node_modules directories to free up disk space.

An individual received a fake job offer that led to an NPM package containing a full information-stealing malware. The attack was part of a supply chain compromise, demonstrating how cybercriminals use fake recruitment to distribute malicious code.

A developer created an NPM package called "budget-agent" designed to prevent AI agents from consuming excessive API credits by setting budget limits and tracking usage.

Despite advances in the ecosystem, JavaScript still lacks a native way to ship a full-stack module—combining frontend and backend code in a single, shareable package. The article highlights the ongoing fragmentation between client and server runtimes, which forces developers to rely on workarounds rather than a unified standard.

Q.js is a modern front-end JavaScript framework for 2026 that requires no build scripts or bundlers, distinguishing itself from frameworks like React. It offers features such as reactive state, virtual DOM, and component-based architecture while aiming to simplify the development workflow.

Downlaude is a terminal tool that lets users check Claude AI's status directly from the command line, eliminating the need to open a browser. The developer shared it on Hacker News and is asking for community feedback.

The author argues that development dependencies in software projects should be avoided or minimized because they introduce risks, maintenance burden, and security vulnerabilities. By keeping dependencies only for runtime needs and using tools to verify production code, developers can reduce complexity and improve project reliability.

The article explains how to protect sensitive secrets (like API keys) from being exfiltrated by AI coding agents or malicious npm packages by using an "airgap" technique—running builds and dependency installations on a separate, offline machine to ensure secrets never touch potentially compromised environments.

The video critiques npm (Node Package Manager), highlighting issues with its package management system, such as dependency bloat, security risks, and inefficiencies. It calls for improvements to address these ongoing problems in the JavaScript ecosystem.

Malicious NPM packages disguised as Mastra tooling were found targeting browser extensions for Zapier and security tools. The attack exfiltrates credentials and sensitive session data via compromised npm dependencies.

A September 2025 supply-chain attack on the NPM ecosystem affected packages with a combined 2.6 billion weekly downloads, with many developers first learning about the breach through Twitter rather than official channels. The incident highlighted ongoing vulnerabilities in open-source dependency management and communication gaps during security incidents.

A typosquatted NPM dependency called "easy-day-js" was used to backdoor 140 packages in the Mastra ecosystem, including the main "mastra" package. The malicious versions exfiltrated system data and were disguised to mimic the legitimate "easy-dates-js" library.

The Mastra npm organization was compromised in a supply chain attack, with multiple packages trojanized to deliver a remote payload via the easy-day.js dependency. Attackers injected malicious code that downloads and executes a remote payload, putting downstream users at risk.

Multiple Mastra NPM packages were compromised, raising security concerns for users of the affected packages. The issue involves unauthorized access to published packages on the npm registry. Users are advised to review the incident and take appropriate security measures.

Pacwich is a lightweight monorepo tool that works on top of Bun, npm, or pnpm with zero required config, using plain package.json scripts for orchestration. It was redeveloped from an earlier Bun-only package called bun-workspaces to be decoupled from any specific package manager. Future plans include composing scripts into more complex workflows beyond parallel/series execution.

Red Hat Insights' JavaScript packages on NPM suffered a supply chain attack stealing AWS, GCP, Azure, Kubernetes, Vault, npm, and CircleCI credentials, self-propagating via npm tokens and bypass_2fa. The incident is the latest in a long pattern of such attacks on NPM, the package manager where they regularly occur.

A developer proposed replacing a `node -e` command with `npm init` in Antora documentation, citing it as the official NPM method. The maintainer rejected the change, arguing that `npm init` adds unnecessary keys to `package.json` and that the direct approach is cleaner. The incident raises the question of whether developers should always follow official supplier recommendations.

NPM has introduced a new `allowScripts` opt-in install-script policy, giving users more control over whether package lifecycle scripts run during installation. This feature is designed to enhance security and privacy.

A large-scale NPM supply chain campaign involving 176 malicious packages targeted internal dependency systems. The packages were designed to evade detection by mimicking legitimate internal modules, aiming to compromise private registries and exfiltrate sensitive data from organizations.

A malware developer who created malicious NPM packages targeting Claude AI users' secrets accidentally leaked their own GitHub private token in the process. The attack was part of a supply chain campaign, but the developer's sloppiness exposed their identity and credentials. The incident highlights ongoing risks in the open-source ecosystem.

The article introduces StageClicker, a tool that simplifies setting up staged npm publishing for packages, requiring approximately one click per package to configure the workflow.