Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by ...
GCN

After 500-plus poisoned packages hit the world’s biggest code registry, a new 2FA gate became the first opt-in human checkpoint in npm’s nearly seventeen-year hist…

GitHub's npm registry shipped staged publishing in May 2026, the first mandatory 2FA human checkpoint in its 16-year history, ...