InfoQ Homepage NPM Content on InfoQ
-
vlt 1.0 Ships as a Drop-in npm Replacement with Phased Installs, Graph Queries, and Malware-Blocking
vlt, created by the original npm team, has launched version 1.0 as a drop-in replacement for npm. It features phased installations to prevent automatic script execution, a queryable dependency graph with over 60 selectors, and hosted registries that block malicious packages. The tool aims to enhance security and streamline the JavaScript development process.
-
pnpm 12 Rewrites Package Manager in Rust, Accelerating Installs While Preserving pnpm 11 Workflows
pnpm 12 has transitioned to a native Rust implementation, maintaining compatibility with pnpm 11 commands, flags, and formats. This update enhances startup and filesystem performance, particularly when using existing caches. Community feedback highlights the performance gains while noting some trade-offs in larger artifact sizes.
-
npm Staged Publishing Available, Adding a Human Approval Step before Packages Go Live
npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags.
-
TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages
TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious package versions in just six minutes, exposing developers and CI/CD systems to credential theft and malware propagation.
-
npmx Reaches Alpha: Community Driven Alternative Browser for the npm Registry
npmx is an open-source package browser for the npm registry, developed by Daniel Roe and over 250 contributors. It emphasizes speed and features absent in the official npmjs.com interface, such as install size calculations and outdated dependency warnings. Feedback highlights its quick search performance but raises design concerns. The project is available on GitHub.
-
pnpm 11 Release Candidate: ESM Distribution, Supply Chain Defaults and a New Store Format
pnpm 11 RC has been released, featuring significant changes in performance, security, and configuration. Key updates include an SQLite-backed store index, tighter security defaults, and a consolidated build script setting. It now requires Node.js v22 or later. Global installs are isolated by default, and new commands enhance usability. Migration guidance is available in the documentation.
-
Axios npm Package Compromised in Supply Chain Attack
On March 31, 2026, two versions of the Axios library were compromised and found to contain a Remote Access Trojan. The malicious packages were published through a hijacked maintainer account. The Axios team is investigating how the breach occurred and has deprecated the affected versions. Security experts emphasize the need for better dependency management.
-
NPM Ecosystem Suffers Two AI-Enabled Credential Stealing Supply Chain Attacks
The Node Package Manager (npm) ecosystem has suffered from two major supply chain attacks in recent months, affecting hundreds of packages and exposing developers to credential theft and data exfiltration. The attack vector of these incidents shows an AI-enabled evolution of how open-source software dependencies can be compromised.
-
vlt Introduces New JavaScript Package Manager and Serverless Registry
Introducing **vlt**, a groundbreaking open-source JavaScript package manager by former npm team members. Designed as an intuitive drop-in replacement, vlt simplifies dependency management with an innovative query selector and new export formats. Alongside it, **vsr** offers a fair-source serverless registry for enhanced package access control. Embrace the future of JS tooling!
-
TypeSpec: a Practical TypeScript-Inspired API Definition Language
Recently, Microsoft engineers officially unveiled TypeSpec, a new language tailored for API-centric development that addresses the complex needs of modern API design. TypeSpec is an open-source, extensible language inspired by TypeScript and C#. It supports various protocols and serialization formats, enabling developers to use a single tool to manage multiple API specifications.
-
Manifest Confusion Paves the Way to New npm Supply Chain Threats
A recent report by former npm engineering manager Darcy Clarke found that the npm registry does not validate manifest information against the contents of its corresponding package tarball. This creates a double source of truth that attackers can exploit to hide scripts or dependencies, says Clarke.
-
Malicious PyPI Package Removes netstat, Tampers with SSH Config
A recent report by Sonatype security researcher Ax Sharma highlights newly discovered malicious packages on the PyPI registry, including aptx, which can install the Meterpreter trojan disguised as pip, delete the netstat system utility, and tamper with SSH authorized_keys file.
-
NPM Package Masquerading as Popular Material Tailwind Library To Install Malicious Code
Researchers at ReversingLabs discovered a malicious npm package masquerading as the Material Tailwind library. Their finding highlights a new trend for threat actors to install malicious code, dubbed impostor packages, say the researchers.
-
Securing the Open-Source Software Supply Chain
Recent findings by security researchers at SonarSource showed multiple security vulnerabilities in popular package managers, including Pip, Yarn, Composer, and others. Package managers, though, are not the only weak link in the open source security chain. InfoQ has spoken with Sonatype CTO Brian Fox.
-
Npm 7 Now Generally Available, Supports Workspaces and Deterministic Builds
The recently released npm 7 adds several features requested by developers, e.g. support for workspaces, better support for peer-dependency management, or deterministically reproducible builds. npm 7 is a big release that includes several breaking changes aiming at improving the overall developer experience.