On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages ...
'This is unironically a malware nuclear missile.' ...
Attackers stole a long-lived npm token from the lead axios maintainer and published two poisoned versions that drop a ...
Security firm Socket advised developers to check dependencies for affected Axios versions and remove or roll back compromised ...
Axios functions as pre-built software that a developer can easily incorporate into a JavaScript project. However, a hacker ...
Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver ...
A new security bypass has users installing AI agent OpenClaw — whether they intended to or not. Researchers have discovered that a compromised npm publish token pushed an update for the widely-used ...
A researcher at Koi Security says the two key platforms have not plugged the vulnerabilities enabling the worm attacks, and ‘the JavaScript ecosystem deserves better.’ Javascript developers should ...
The new self-replicating worm iteration has destructive capabilities, erasing home directory contents if it cannot spread to more repositories. Approximately 640 NPM packages have been infected with a ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results