When the code you depend on is the attack: npm, packages, SBOMs, and third-party access.
A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.
Vercel confirmed a security breach on April 18-19, 2026, tracing back to a compromised third-party AI tool and a single employee's Google Workspace connection. Here is the full attack chain, what was actually exposed, and what you need to do right now.
A critical SSRF flaw in Axios was used in a North Korean supply chain attack. Here's what it does and how to patch it today.
On March 31, 2026, Anthropic published version 2.1.88 of Claude Code to the npm registry. Bundled inside was a 59.8 MB JavaScript source map file
Your application is only as secure as every package it depends on. In September 2025, attackers compromised 27 npm packages with 2.6 billion weekly downloads by phishing one maintainer.
