On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages ...

Security firm Socket advised developers to check dependencies for affected Axios versions and remove or roll back compromised ...

A simple new mug featuring the Disneyland “D” logo is available at Disneyland Resort, as well as a castle keychain. This stoneware mug has a matte white finish. The Disneyland “D” logo is debossed ...

JavaScript’s low bar to entry has resulted in one of the richest programming language ecosystems in the world. This month’s report celebrates the bounty, while also highlighting a recent example of ...

Maintainer Jordan Harband writes on Bluesky that attackers had taken over the account of another project manager. Versions 3.3.1 and 5.0.0 of the package are affected. Both versions were apparently ...

Anyone who has recently downloaded the JavaScript SDK web3.js from Solana from the package manager npm may have picked up malicious code. The origin is probably a phishing attack on maintainers of the ...

Back in July, Apple made it so that Chrome on Mac could access iCloud Keychain passwords via an updated browser extension. Chrome 118 will soon let you access passkeys stored in iCloud Keychain. Today ...