bx-ui-framework Authentication Malicious Package Alert
MAL-2026-15866 flags all published versions of @bx-ui-framework/authentication as malicious. Check exposure, remove it, and investigate installs.
supply chain security
How software supply chain attacks work and what actually stops them, from registry proxies to CI gates to advisory feeds.
Malicious npm Packages: Detection and Response Guide
A field guide to how malicious npm packages spread, how to detect them before install, and how to contain exposure safely.
npm Registry Firewall: How It Blocks Bad Packages
A practical guide to how registry firewalls intercept npm package requests, enforce policy, and complement SCA and behavioral analysis.
6 Malicious npm Packages Disclosed September 4
Six malicious npm packages were disclosed September 4. Check your lockfiles, contain affected hosts, and rotate potentially exposed credentials.
CodeCatalyst Blueprints Command Injection: Upgrade Now
CVE-2026-85012 lets a repository contributor inject OS commands during blueprint resynthesis. Check for affected versions and upgrade.
Quantix Finance npm Malware: 10 Packages Steal Secrets - all you need to know
Ten malicious @quantixfinance packages harvest environment credentials and wallet secrets during npm preinstall. Here is how to check and respond.
Stellarshift and Tailwind npm Malware Alert
Six malicious npm packages use targeted install hooks, host-data exfiltration, and a self-erasing blockchain-C2 loader. Check exposure and respond safely.
Orval npm RCE Advisories: Upgrade to 8.22.0
Three Orval advisories enable import-time RCE, SSRF, and file inclusion. Check exposure and upgrade the npm package to 8.22.0 or later.
eslint-rxjs 1.0.1 Is Malicious: Check Exposure
OpenSSF flagged eslint-rxjs 1.0.1 as malicious. Check lockfiles and CI logs, remove it, and investigate the affected environment.
FOSSA Alternative for npm Supply-Chain Security (2026)
FOSSA is built for license compliance, not blocking malicious npm packages. Compare the best FOSSA alternatives for npm supply-chain security in 2026.
Veracode Alternative for npm Supply-Chain Security (2026)
Veracode is a heavyweight AppSec suite with opaque per-app pricing. If your problem is malicious npm packages, a registry firewall gets you there in minutes.
@testrelic/playwright-analytics 2.13.0 is malicious: check now
@testrelic/playwright-analytics 2.13.0 shipped an obfuscated postinstall loader (OSV MAL-2026-15565). Live ~3.5h on 27 Aug 2026. How to check your lockfiles, what to rotate, and how to upgrade.