CVE-2026-105844 - plugin-import-export
The free Payload content management system and its import‑export plugin allow anyone on the internet to send specially crafted data that can make the application behave…

Too many irrelevant or confusing CVEs? Use stackflag.com

#payloadcms #npm #CVE #infosec

CVE-2026-102829 - git-js
The @simple‑git/argv-parser library used by simple‑git does not treat the VISUAL environment variable as a risky editor setting. Because VISUAL is dropped before safety checks,…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitjs #simplegit #npm #CVE #infosec

CVE-2026-102828 - git-js
The simple-git library does not block a special Git setting called trailer.<token>.cmd, which can run shell commands. If an application passes untrusted data into simple-git’s…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitjs #steveukx #npm #CVE #infosec

🚀 How to Deploy #Phanpy on #AlmaLinux #VPS

This article provides a guide demonstrating how to deploy Phanpy on AlmaLinux VPS.
What is Phanpy?
Phanpy is a modern alternative web frontend for #Mastodon and ...
Continued 👉 #selfhosted #selfhosting #letsencrypt #npm #firewalld #fail2ban

⏱ 57 days of lead time on npm @badzz88/[email protected]: we flagged it, then MAL-2026-17341 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

Continuing with the Pre-Install Dependency Admission Controller. That prevents and monitors packages being installed. #npm
Now even PRs are monitored. See how it works

@reversinglabs.com
Malicious indexed-btree bypasses npm install-script defenses by activating at runtime and exfiltrating data.
-
IOCs: indexed-btree
-
#SupplyChain #ThreatIntel #npm

へぇ、npmのTrusted Publishingで配布タグも操作できるようになった。タグ操作だけのために長命トークンを残さずに済む。これは嬉しい。……でも、あたしの指は「Allow npm dist-tag」のチェック欄で止まった。https://x.com/SupersocksIntel/status/2105696315128664095 #npm

CVE-2020-12265 - decompress
The decompress libraries used to unzip files in JavaScript applications can be tricked into running unwanted code when handling specially crafted archive files. This…

Too many irrelevant or confusing CVEs? Use stackflag.com

#decompress #sindresorhus #npm #CVE #infosec

Ship Cleaner Packages (Without the ./dist or ./src Folder) by Publishing a Subfolder to npm, by @[email protected]:

https://www.bram.us/2026/09/20/npm-publish-subfolder/?ref=frontenddogma.com

#dependencies #npm #filehandling

⏱ 49 days of lead time on npm [email protected]: we flagged it, then MAL-2026-17404 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

Node.js Built-Ins That Replaced npm Packages, by @flaviocopes.com:

https://flaviocopes.com/node-builtins/?ref=frontenddogma.com

#nodejs #npm #dependencies

Resolving Dependency Hell

#programming #npm #Softwaredevelopment #Techhumor #Standards

https://programmerhumor.io/programming-memes/resolving-dependency-hell-wd1s

CVE-2026-12866 - expr-eval
The expr-eval package used in several JavaScript projects contains a flaw that could let an attacker run unwanted code on your system. This affects the expr-eval library and…

Too many irrelevant or confusing CVEs? Use stackflag.com

#expreval #rootio #npm #CVE #infosec

ONLYOFFICE Create AppでDocs連携のサンプルWebアプリを構築する

#ONLYOFFICE #Next.js #React #Docker #npm

🚀 How to Deploy #CapRover on #Ubuntu #VPS

This article provides a guide demonstrating how to deploy CapRover on Ubuntu VPS.
What is CapRover?
CapRover is a free, open-source Platform-as-a-Service (PaaS) that ...
Continued 👉 #selfhosting #npm #ufw #certbot #nodejs #letsencrypt #selfhosted #git

⏱ 46 days of lead time on npm [email protected]: we flagged it, then MAL-2026-17444 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

Attackers are poisoning software updates to steal developer & cloud creds via CI/CD token abuse. #SupplyChain #DevSecOps #CI_CD #Security #Credentials #npm https://thedailytechfeed.com/supply-chain-nightmare-trusted-software-updates-weaponized-for-credential-theft/

An npm package that never runs at install. It fires inside `BTree.prototype.set` when your code stores key 100.

No install hook, so --ignore-scripts saves nothing. Loader beacons to Slack/Telegram, pulls stage two from an Ethereum contract. ~2M weekly downloads.

#npm #DevSecOps