npm

Vercel now automatically blocks known malicious npm packages during builds before their install scripts can run, protecting user code and secrets from exfiltration with no action required.

A developer explains how npm's typosquatting protection rejected their package name "estee" for being too similar (Levenshtein distance 2) to "testem", arguing that a fixed edit-distance threshold unfairly blocks short names and doesn't scale down well to small string lengths.

The maintainer and the vulnerability database are at odds over a security issue in braces 3.0.3. The maintainer insists the vulnerability is invalid and refuses to release a fix, leaving a large number of users to bear the ongoing cost of triaging alerts.

Deno is joining Cloudflare and winding down its runtime investment, while JSR continues on Cloudflare's infrastructure and the team merges celld into workerd. The post reflects on how Deno's competition pushed Node/npm ecosystem improvements even though Deno itself never reached critical mass.

有报道称 Zod 4.6.6 版本可能被恶意软件入侵，而 Zod 是广受欢迎的 TypeScript-first 数据验证库。目前内容主要来自 Zod 的官方 GitHub 仓库说明。

antfu 发布 @antfu/skills，一个类似 @antfu/eslint-config 的打包式 agent skills 集合，通过 skills-npm 提供包管理器式的安装体验，可自动同步到 Claude Code、Cursor、OpenCode 等 agent 的技能目录。

pi-llama-skip-reasoning is a Pi.dev extension that lets users force a local Qwen 27B llama.cpp model to stop reasoning and answer immediately via a /skip-reasoning command or Alt+T shortcut, using llama.cpp's native reasoning-skip mechanism.

This article reveals that the npm package mathmain contains a hidden remote access implant with an encrypted loader, which decrypts and executes malicious code when a specific equation is solved using the library.

OpenWiki announces a new integration with Cursor, enhancing its accessibility for coding agents. The integration allows users to install and set up with just two npm commands.

The Model Context Protocol (MCP) is experiencing explosive growth, with Vercel reporting a 564% increase in tool calls over three months and rising npm downloads for mcp-handler.

GitHub's Dependabot now implements a three-day cooldown for non-security version updates to give security scanners time to detect poisoned releases, helping mitigate supply chain attacks.

Introducing the open-source project Comimi, a comic reader library designed for the web, supporting multiple reading modes, customizable features, and a lightweight implementation, focused on enhancing the actual reading experience.

An npm package that automates feedback handling in apps by opening pull requests through a cloud agent.

Una librería en Rust que convierte documentos Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV y PDF a Markdown, disponible vía npm, Python y CLI, destacando su utilidad para LLMs.

Attackers compromised the GitHub account of the maintainer behind keyv and related npm caching libraries, injecting a credential-stealing worm across multiple packages with over 2 billion combined monthly installs.

Hotcell provides local sandboxes for AI agents on Mac, Linux, and bare metal, installable via npm.

OpenClaw announces extended-stable releases with monthly backported fixes and a public maturity scorecard, moving closer to official LTS support.

GitHub announces new security measures for npm and GitHub Actions to disrupt common supply chain attack techniques, including preventive account protection for high-impact accounts and safer default checkout settings.

OpenAI released the open-source Codex Security CLI, available via npm, to help developers with security tasks.

A malicious npm package (s1ngularity) exploited post-install hooks to repurpose installed AI coding agents as credential scanners, stealing secrets from developers. Docker's blog discusses how Docker Sandboxes can mitigate such attacks by isolating credentials from agent reach.