An attacker took over the npm account behind react-native-international-phone-number and react-native-country-select, publishing three waves of malicious versions containing malware linked to the Glas...

CVE-2026-25896 allows XSS and injection attacks by shadowing XML built-in entities in fast-xml-parser via regex wildcard in entity name

First draft

Analysis of Shai-Hulud 2, a new npm supply chain attack using Bun for execution, credential theft, and CI/CD propagation, with mitigation guidance.

YouTube video by Paul Beckwith

By Judith Roberts * As an attorney I’m deeply alarmed by an incident that occurred just this week and feel compelled to share it—to raise aw...