56
NPM package ‘is’ with 2.8M weekly downloads infected devs with malware
(www.bleepingcomputer.com)
this post was submitted on 24 Jul 2025
56 points (100.0% liked)
Cybersecurity
7940 readers
35 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
So, is that just a 'developer' component, or have I got to analyse all my systems now for the NPM components in the article's list?
Little late to the party here, and I'm not primarily a js dev, but... yes. It looks like it's one of those syntactic sugar kind of packages that devs love to use. The bonus here is you can probably use a find-grep kind of process to check
package-lock.jsonfor references to the package. (there might be an npm command, but like I say - not a js dev.)For example: