InfoWorld

Your npm install was safe. What happens when the package runs?

Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...
GIGAZINE

The era of simply running 'npm install' to execute code is coming to an end, as npm plans to disable automated script execution by default.

The JavaScript package management tool 'npm' is scheduled to implement a change in its 'npm v12' release, which is expected in July 2026. This change will prevent the script that is automatically ...

[Warning] Infected just by running 'npm install'? The cyberattacks and vulnerabilities of October 2026 that shook AI-reliant solo developers

"Wait, can my computer be hijacked just by writing code?"Yes, it can.And that's even if you haven't written any malicious code yourself.Apparently, malicious programs can sometimes be hidden in the ...
InfoWorld

GitHub finally pulls the plug on automatic install script execution for npm

The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner. The ability ...
Ars Technica

Hundreds of code libraries posted to NPM try to install malware on dev machines

An ongoing attack is uploading hundreds of malicious packages to the open source node package manager (NPM) repository in an attempt to infect the devices of developers who rely on code libraries ...
BleepingComputer

GitHub finds 7 code execution vulnerabilities in 'tar' and npm CLI

GitHub security team has identified several high-severity vulnerabilities in npm packages, "tar" and "@npmcli/arborist," used by npm CLI. The tar package receives 20 million weekly downloads on ...