Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised
safedep.io
A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds of @antv scoped packages, affecting 15M+ monthly downloads.
  • 9point6@lemmy.worldEnglish
    7·
    19 days ago

    The npm registry maintainers really need to do something about this, feels like a monthly occurrence now.

    Particularly in the era where some devs seem to be happily letting Claude go and install whatever dependencies it likes in projects without second thought