socket.devarticle

Socket: npm Tooling Bug Incorrectly Marks 13 Single-Character Packages as Security Holders

Socket reported that npm's registry tooling incorrectly applied 0.0.1-security placeholder versions and moved the 'latest' dist-tag to that placeholder for 13 single-character packages (c, r, w, -, m, p, i, n, 3, 2, x, 6, 4). npm confirmed it was a tooling bug, not a compromise, and rolled it back; older package versions remained available throughout. The piece advises developers to check lockfiles for the 0.0.1-security tag to confirm their package manager resolved the intended version rather than the temporary placeholder.