Hackers injected malicious code into nearly a dozen 20 NPM packages with billions of weekly downloads in a software supply chain attack after phishing a maintainer’s account.

According to ReversingLabs' 2025 Software Supply Chain Security Report, 14 of the 23 crypto-related malicious campaigns in 2024 targeted npm, with the remainder linked to PyPI.

Adam Oram is a Senior Editor at CNET. He studied Media at Newcastle University and has been writing about technology since 2013. He previously worked as a Senior Writer at iMore, Deals Editor at ...

Everyday Health’s team of board-certified physicians and health professionals contribute to the creation and review of content, ensuring that the information is useful, up to date, and accurate. Susan ...