npm security

Securing the npm dependency chain — scanners, registry-layer blocking, advisory data, and how compromised packages actually reach production.

@testrelic/playwright-analytics 2.13.0 is malicious: check now

@testrelic/playwright-analytics 2.13.0 is malicious: check now

@testrelic/playwright-analytics 2.13.0 shipped an obfuscated postinstall loader (OSV MAL-2026-15565). Live ~3.5h on 27 Aug 2026. How to check your lockfiles, what to rotate, and how to upgrade.

MariaDB connector CVE-2026-55215: check if you're exposed

MariaDB connector CVE-2026-55215: check if you're exposed

Three CVEs were published for the mariadb npm connector on 28 Aug 2026. With ssl:true and no CA, the driver sends your DB password before verifying the server. Here's how to check and fix it.

Checkmarx Alternative for npm Supply-Chain Security (2026)

Checkmarx Alternative for npm Supply-Chain Security (2026)

Checkmarx One is a strong AppSec platform, but it scans after the fact. If the job is stopping malicious npm packages before they install, on laptops, in CI and in AI agents, a registry firewall is cheaper and simpler.

openapi-react-query-codegen compromised: are you exposed?

openapi-react-query-codegen compromised: are you exposed?

Ten malicious @7nohe/openapi-react-query-codegen versions shipped a credential-stealing npm worm on Aug 28, 2026, with valid provenance. Which versions, how to check your lockfiles and machines, and how to remediate.

Black Duck Alternative for npm Supply-Chain Security (2026)

software composition analysis

Black Duck Alternative for npm Supply-Chain Security (2026)

Looking for a Black Duck alternative for npm? Compare registry firewalls vs scan-time SCA on price, setup, malware blocking and AI-agent coverage.

Critical Next.js RCE (CVE-2026-75604 + AVIF): upgrade now

Critical Next.js RCE (CVE-2026-75604 + AVIF): upgrade now

Two critical unauthenticated RCE flaws hit Next.js (Windows path traversal + AVIF/libheif). Check exposure in five minutes and upgrade to 15.5.24 or 16.3.3.

Mend Alternative for npm Supply-Chain Security (2026)

Mend Alternative for npm Supply-Chain Security (2026)

Mend.io charges up to $1,000 per developer per year for a bundle most npm teams only partly use. See the best Mend alternatives for npm supply-chain security, including a drop-in registry firewall that blocks malicious packages across CI, laptops, and AI agents.

npm Mirror Phishing via unpkg: Check If You're Exposed

npm Mirror Phishing via unpkg: Check If You're Exposed

24 malicious npm packages abused unpkg mirrors to host fake Cloudflare CAPTCHA phishing pages (OX Security, Aug 25 2026). Check your exposure, IOCs, and fixes.

The Nx s1ngularity npm supply-chain attack: what happened and how to stay protected

supply chain security

The Nx s1ngularity npm supply-chain attack: what happened and how to stay protected

The Nx s1ngularity npm attack poisoned nx and @nx/* versions and hijacked AI coding CLIs to steal secrets. Affected versions, IOCs, and how to check exposure.

An MCP Server That Checks npm Packages Before Your Agent Installs Them

An MCP Server That Checks npm Packages Before Your Agent Installs Them

Your coding agent can now ask whether an npm package has known advisories before it installs it. An anonymous MCP server at installsafe.io/mcp, three tools, no API key.

JFrog Xray Alternative for npm Supply-Chain Security (2026)

supply chain security

JFrog Xray Alternative for npm Supply-Chain Security (2026)

JFrog Xray + Curation is powerful but means adopting Artifactory and an enterprise contract. Here's an honest comparison with a drop-in npm registry firewall that blocks malicious packages across CI and AI agents.

Malicious npm Packages Deploy RedShell (RedC2): Check If You're Exposed

Malicious npm Packages Deploy RedShell (RedC2): Check If You're Exposed

A new campaign (Aug 24, 2026) hides the RedShell RedC2 Linux implant inside decoy "streak"/"map"/"calc" npm packages. Which packages are affected, how to check if you're exposed, and how to remediate.