The Latest Breaking News from NPM

Drug-dealing, makeshift weapons and a ‘culture of fear’ at Villawood detention centre, report warns

Prolonged detention of children, insufficient staffing and hazardous damage to buildings are among the ombudsman’s concerns

The Guardian - AU · Aug 20

OpenAI Codex tool with over 29,000 downloads linked to malicious npm supply chain attack stealing authentication tokens

A tool started benign and turned sour after a little while, stealing tokens and granting persistent access.

TechRadar · Jun 1

GitHub hit with another major attack — Megalodon hits over 5,000 repos with malware-laden commits

A TeamPCP copycat was just spotted hitting thousands of GitHub repos with an infostealer.

TechRadar · May 25

Kia Carnival escape one of 12 since US firm took control of Australian immigration detention, damning report finds

Staffing levels at centres ‘critical’ under Management and Training Corporation, prisons watchdog says

The Guardian - AU · Mar 10

Worrying WhatsApp attack can steal messages and even accounts - here's how to stay safe from "poisoned" attack

A fork of a popular project was found on npm, but not before it amassed tens of thousands of downloads.

TechRadar · Dec 23, 2025

Thousands of fake packages flood npm registry in major attack - here's what we know

The campaign could be in preparation for a malicious attack, or it could be a way to earn crypto tokens.

TechRadar · Nov 13, 2025

GitHub is finally tightening up security around npm following multiple attacks

Github is looking to harden package publication with mandatory 2FA for local publishing, and more.

TechRadar · Sep 24, 2025

A terrifying, self-replicating malwaere has infected npm packages with over 2 million downloads per week - here's how to stay safe

Supply chain attacks against npm users continue with a new self-propagating worm.

TechRadar · Sep 17, 2025

Compromised files replace npm packages with a combined 2 billion weekly downloads

The "biggest supply chain attack" in the history of npm took place recently, affecting almost two dozen packages.

TechRadar · Sep 9, 2025

JavaScript packages with billions of downloads were injected with malicious code in world's largest supply chain hack, geared to steal crypto — a phishing email is all it took to undermine npm packages

JavaScript packages with billions of downloads were compromised by an unknown threat actor looking to steal cryptocurrency.

Tom’s Hardware · Sep 9, 2025