🧰 npm CLI

The items that name it 6

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeupas affected products2026-09-20

  Global npm CLI at node_modules/npm/lib/cli.js targeted for persistence injection by the final RAT payload.

• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas affected products2026-07-31

  npm publish now introduces ~5 minute delay (up to 15+ minutes at peak) before a package is installable; npm dist-tag still works during pending publish, but npm deprecate and npm unpublish do not

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeupas affected products2026-07-30It is written here as npm CLI (global).

  <npm root -g>/npm/lib/cli.js patched for worm propagation; every subsequent npm invocation re-executes the malware

• Socket: Mini Shai-Hulud
  articleas tools2026-05-22

  Registry client; v11.15.0 merged the npm stage command enabling staged publishing; v11.10.0 (Feb) shipped bulk trusted publishing config GA

• VSCode Lifecycle Script Malware
  writeupas affected products2026-05-16
• Supply Chain Compromise of axios npm Package
  writeupas tools2026-03-31

  Used by attacker to publish backdoored packages directly, bypassing GitHub Actions OIDC-based CI/CD publishing workflow