NPM Library Vulnerability Exposes Millions to Potential Attacks

A critical vulnerability has been discovered in a widely used NPM library, affecting millions of developers and applications worldwide. This security flaw allows attackers to execute arbitrary code remotely, potentially leading to data breaches and system compromises. The vulnerability stems from improper input validation and insufficient sanitization within the library's core functions. Developers are urged to update to the latest patched version immediately to mitigate risks. This incident highlights the importance of rigorous security audits in open-source software dependencies, which are integral to modern software development. Organizations relying on this NPM package should conduct thorough assessments of their software supply chain to identify and remediate any exposure. The cybersecurity community continues to emphasize proactive vulnerability management and timely patching to defend against evolving threats targeting software ecosystems.

This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Nov 2025 13:15:11 +0000

Cyber News related to NPM Library Vulnerability Exposes Millions to Potential Attacks

'everything' blocks devs from removing their own npm packages - Since these 3,000+ packages manage to include every single npm package on the npmjs.com registry as their dependency, npm package authors who have ever published to the npm registry would now be unable to remove their packages at will, because of ...
1 year ago Bleepingcomputer.com

9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
2 years ago Esecurityplanet.com

npm 'accidentally' removes Stylus package, breaks builds and pipelines - Panya (the former maintainer of Stylus) used their own account to release a package containing malicious code (for security research purposes? I am unsure), but did not release a new version of Stylus containing malicious code. BleepingComputer ...
4 months ago Bleepingcomputer.com

CVE-2022-29244 - npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of ...
3 years ago

NPM Library Vulnerability Exposes Millions to Potential Attacks - A critical vulnerability has been discovered in a widely used NPM library, affecting millions of developers and applications worldwide. This security flaw allows attackers to execute arbitrary code remotely, potentially leading to data breaches and ...
1 month ago Cybersecuritynews.com CVE-2024-12345

Ontario public library shuts down most services due to cyberattack - A popular library in Ontario, Canada was forced to shut down most of its services this week due to a cyberattack - the latest library to face issues after hackers infiltrated its systems. The London Public Library, which services the Canadian city's ...
1 year ago Therecord.media

Lazarus Hackers Weaponized 6 npm Packages To Steal Logins - The hackers successfully compromised six popular npm packages, injecting malicious code designed to harvest login credentials from thousands of developers and organizations worldwide. A sophisticated supply chain attack orchestrated by the notorious ...
9 months ago Cybersecuritynews.com Lazarus Group

The mystery of the targeted ad and the library patron The Register - Feature In April, attorney Christine Dudley was listening to a book on her iPhone while playing a game on her Android tablet when she started to see in-game ads that reflected the audiobooks she recently checked out of the San Francisco Public ...
1 year ago Go.theregister.com

Rhysida ransomware gang claims British Library cyberattack - The Rhysida ransomware gang has claimed responsibility for a cyberattack on the British Library in October, which has caused a major ongoing IT outage. Rhysida is auctioning off the data it reportedly stole from the United Kingdom's national library ...
2 years ago Bleepingcomputer.com Rhysida Medusa

Ledger JS library poisoned to steal $650K+ from wallets The Register - Cryptocurrency wallet maker Ledger says someone slipped malicious code into one of its JavaScript libraries to steal more than half a million dollars from victims. The library in question is Connect Kit, which allows DApps - decentralized software ...
1 year ago Go.theregister.com

GitHub tightens npm security with mandatory 2FA for access tokens - GitHub has announced a significant security enhancement for npm package maintainers by mandating two-factor authentication (2FA) for all access tokens. This move aims to bolster the security of the npm ecosystem, which is critical given the ...
2 months ago Bleepingcomputer.com

Toronto Public Library 'remains a crime scene' after ransomware attack - The Toronto Public Library is still in the process of recovering from a ransomware attack that limited its offerings and required wholesale changes to how the organization runs. Toronto City Librarian Vickery Bowles published a lengthy note on ...
1 year ago Therecord.media

Malicious NPM packages fetch info-stealer for Windows, Linux, macOS - A recent cybersecurity investigation has uncovered malicious NPM packages that distribute an info-stealer malware targeting Windows, Linux, and macOS platforms. These packages, hosted on the popular Node Package Manager (NPM) repository, have been ...
1 month ago Bleepingcomputer.com

Ransomware takes British Library goes offline - When the British Library was infected with ransomware, few could have predicted how damaging the attack would be. A month later, the Library's IT systems are still offline - and now hackers are threatening to sell stolen personal data too. On 31st ...
1 year ago Pandasecurity.com Rhysida

British Library: Ongoing outage caused by ransomware attack - The British Library confirmed that a ransomware attack is behind a major outage that is still affecting services across several locations. Over 11 million visitors use the library's website annually, with more than 16,000 people using its collections ...
2 years ago Bleepingcomputer.com Medusa

British Library: Finances are healthy amid cyber rebuild The Register - The British Library is denying reports suggesting the recovery costs for its 2023 ransomware attack may reach highs of nearly $9 million as work to restore services remains ongoing. Reports at the weekend suggested the ransomware recovery costs were ...
1 year ago Go.theregister.com Rhysida

Malicious NPM Package Mimics as Popular Nodemailer - A recent cybersecurity incident has revealed a malicious npm package designed to impersonate the widely-used Nodemailer library, a popular tool for sending emails in Node.js applications. This fake package was uploaded to the npm registry, aiming to ...
3 months ago Cybersecuritynews.com

CVE-2021-29486 - cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an ...
2 years ago

Developers Beware of npm Phishing Email That Steal Your Login Credentials - The phishing domain operates as a full proxy of the npm website, seamlessly replicating the user interface while intercepting login credentials through fake authentication pages accessible at with unique tracking tokens. Cyber Security News is a ...
4 months ago Cybersecuritynews.com

PhantomRaven Attack Involves 126 Malicious NPM Packages - The PhantomRaven cyberattack has been uncovered involving a staggering 126 malicious NPM packages, posing a significant threat to the software development community. These packages were designed to infiltrate systems by exploiting the widely used ...
1 month ago Cybersecuritynews.com PhantomRaven

The year of Mega Ransomware attacks with unprecedented impact on global organizations - A Staggering 1 in every 10 organizations worldwide hit by attempted Ransomware attacks in 2023, surging 33% from previous year, when 1 in every 13 organisations received ransomware attacks Throughout 2023, organizations around the world have each ...
1 year ago Blog.checkpoint.com

CVE-2021-43616 - ** DISPUTED ** The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier ...
3 years ago

Threat Actors Hijack Popular npm Packages to Steal The Project Maintainers' npm Tokens - Attackers first harvested maintainer credentials through sophisticated phishing emails, then used these stolen tokens to publish malicious package versions directly to npm repositories without making any corresponding changes to GitHub repositories, ...
4 months ago Cybersecuritynews.com

New npm attack poisons local packages with backdoors - Two malicious packages were discovered on npm (Node package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor. In general, when downloading packages from package indexes like PyPI and ...
8 months ago Bleepingcomputer.com