Skip to content

npm publish-time malware scanning

Named by 2 kept items in this workspace.

Search every workspace for npm publish-time malware scanning. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Shai-Hulud Rises From the Dead after 111 days
    writeup2026-09-07

    automated scan that holds every published package for 5 to 15 minutes to check it before it becomes installable; rolled out by npm in July, per npm's changelog goal to catch "the malware we can detect"

  • The OpenSourceMalware Show #15
    talk2026-07-31

    Scans npm packages before they become available for install rather than after; announced July 28, takes ~5 minutes typically, up to 15+ minutes at peak or for complex packages; publisher may receive a notification with option to appeal if blocked.

All technologies in this workspace.