IT之家 3 月 31 日消息，安全研究机构 StepSecurity 昨天发文称，主流 JavaScript 库 Axios 的两个 npm 版本 axios@1.14.1、axios@0.30.4 被恶意植入远程控制代码。 IT之家在此援引 StepSecurity，黑客劫持了 Axios 核心维护者“jasonsaayman”的 npm 账号，将邮箱替换为匿名的 ProtonMail ...

A hacker has gained access to a developer's npm account and injected malicious code into a popular JavaScript library, code that was designed to steal the npm credentials of users who utilize the ...

SAP npm packages poisoned on April 29, 2026 + AES-256-GCM encrypted credential theft + AI coding tools abused for spread.

应用程序开发者近日收到警告：恶意版本的pgserve（一款用于应用开发的嵌入式PostgreSQL服务器）和automagik（一款AI编程工具）已被上传至npm JavaScript注册表，可能危害开发者的计算机安全。

NPM developer qix's account compromise potentially puts user funds at risk by compromising library dependencies used by bitcoin wallets. A major NPM developer, qix, has had their account compromised.

The npm security team has removed today a malicious JavaScript library from the npm website that contained malicious code for opening backdoors on programmers' computers. The JavaScript library was ...

The Node Package Manager (npm) team avoided a disaster today when it discovered and blocked the distribution of a cleverly hidden backdoor mechanism inside a popular —albeit deprecated— JavaScript ...

The Node Package Manager, NPM, has become a powerful and important tool, supporting many different JavaScript frameworks — including JQuery, AngularJS, and React JS. If you’re building JavaScript ...