Days since last NPM compromiseIt has been
since the last major NPM supply chain compromiseOctober 13, 2026:
Auditing the auditor: Unmasking Apex Accelerator
October 13, 2026:
SlugFest: Millions of AI Agents Install npm Packages Exposed to Malicious Takeover through GitHub
September 17, 2026:
WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
August 4, 2026:
Keyv and friends compromised in active Shai-Hulud supply chain attack
July 28, 2026:
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
June 11, 2026:
Solana FakeFix: 25 Malicious npm and PyPI Packages Lure Developers With Fake Stable Builds
June 9, 2026:
Malware in dbmux
June 6, 2026:
The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
June 3, 2026:
IronWorm: Shai-Hulud's rustier cousin
June 1, 2026:
Multiple redhat-cloud-services npm Packages compromised
