#npm Tech News.
2 stories in the last 7 days
The latest npm news, distilled by AI into sharp ~100-word summaries. ByteBrief tracks npm across dozens of tech sources and brings you only what matters, updated hourly. Tap any story for the full brief, or open the original source.
GitHub shipped a default three-day cooldown on npm version update pull requests to slow malware spread. An Actions network firewall technical preview logs outbound traffic to detect credential exfiltration. These changes target common attack techniques in package repositories and CI/CD systems.
Malicious Nx packages published to npm on August 26, 2025, used a post-install hook to scan for installed AI coding agents and invoked them with permission-bypass flags to enumerate credentials. The s1ngularity campaign targeted Claude, Gemini, and Q CLIs on macOS and Linux machines.
Summaries by ByteBrief