Bug Fixes nvm_alias, nvm_version_path: reject .. path components nvm_get_make_jobs: count cores on platforms the case does not name nvm-exec: improve the no-version failure message nvm use: do not...

Sometimes, it's more important to be good than it is to be nice.

ALT: Cat High Five

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

New Stuff nvm install --offline: install from cache without network access Bug Fixes nvm_download_artifact: reject version strings with disallowed characters nvm_get_checksum: pass the tarball n...

Post Mortem: axios npm supply chain compromise Date: March 31, 2026 Author: Jason Saayman Status: Remediation in progress On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were...

Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.

The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Stage 4 committee approval two implementations v8 (node / Chrome) node (for DOMException) spidermonkey (Firefox) jsc (Webkit / Safari) Deno (for DOMException) Porffor es-shims polyfill keisel Boa s...

ALT: a cartoon character is sitting in front of an orange emergency exit sign

minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecos...

Bug Fixes sanitize NVM_AUTH_HEADER in wget path nvm_has_colors: also check if stdout is a terminal nvm_strip_path: avoid gawk-specific RT variable for mawk compatibility nvm_get_default_packages: ...