🧰 npm registry

The items that name it 13

• Agent Baseline Publishes Security Reference Architecture for Software Factories
  articleas affected products2026-10-13It is written here as npm registry (agents reached it directly, bypassing denied-package controls).

  agents reached it directly, bypassing denied-package controls

• vet (SafeDep)
  repoas affected products2026-09-07

  Package manager ecosystem supported/scanned by vet

• Shai-Hulud Rises From the Dead after 111 days
  writeupas affected products2026-09-07

  platform on which publish-time malware scanning (rolled out July) failed to catch a hash-identical known-malicious payload

• Introducing deny list egress policies for Harden-Runner
  articleas affected products2026-09-02It is written here as npm registry (registry.npmjs.org).

  Public registry that default npm clients fetch from/publish to; target of self-propagating campaigns publishing trojanized versions via stolen publish tokens.

• Xygeni Malicious Code Digest 82
  articleas affected products2026-08-08

  Platform hosting the malicious packages described

• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas affected products2026-07-31

  Subject of new publish-time malware scanning announced July 28, 2026; previously scanned every package version post-publish per GitHub's April 2026 post

• Socket: Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
  writeupas affected products2026-07-29It is written here as npm (Node Package Manager) registry.

  Hosted the malicious package cluster (lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, cloud-config-fetcher, and 10 top-layer lure packages)

• npm now freezes high-impact accounts after risky account changes
  articleas affected products2026-06-26

  Registry-level account protections discussed: high-impact account cooldown, staged publishing, trusted publishing, 2FA-enforcement policy, postinstall script blocking planned for v12.

• Socket: pnpm 11.5 Fixes False Trust-Downgrade Alerts for npm Staged Publishes
  articleas affected products2026-06-13

  publishing metadata (_npmUser field, approver field) and publishing modes: classic, trusted, and staged publishing

• Socket: npm Tooling Bug Incorrectly Marks 13 Single-Character Packages as Security Holders
  articleas tools2026-06-13

  package registry whose tooling applied incorrect security-holder metadata to 13 one-character packages

• AWS Well-Architected: Software Supply Chain Security
  articleas affected products2026-06-04

  Target of multiple supply chain attacks since September (Shai-Hulud, Chalk/Debug, tea.xyz, axios)

• Socket: Bitwarden CLI Compromised in Checkmarx Supply Chain Campaign
  writeupas tools2026-05-06

  Package registry used for exfiltration via token theft/republishing and supply chain propagation

• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  articleas affected products

  Nearly 800 (later 1,033 confirmed) malicious packages published delivering RAT/infostealer