A new release of the JavaScript and Node.js package manager, npm, fatally changes file permissions. While that's been fixed, the entire messy process revealed more fundamental problems.

NPM has removed multiple packages hosted on its repository this week that established connection to remote servers and exfiltrated user data. These 4 packages had collected over 1,000 total ...

Researchers have discovered multiple npm packages named after NodeJS libraries that even pack a Windows executable that resembles NodeJS but instead drops a sinister trojan.