npm 12 disables install scripts by default, requiring explicit approval to reduce dependency-based code execution risks.
With npm v12, GitHub closes a central attack vector: installation scripts from dependencies will only run after explicit ...
The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took ...
Researchers have uncovered a supply-chain attack that hides in Python packages, propagates like a worm, and tricks LLM-based ...
Miasma compromised 32 Red Hat packages June 1 via a hijacked CI/CD pipeline producing valid SLSA attestations, then hit 57 more June 3 using Phantom Gyp to evade install monitors. Red Hat confirmed no ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results