https://www.reversinglabs.com/blog/npm-security-shai-hulud
While 2FA and trusted publishing will help, you need tools that give visibility into how packages behave — not just who is publishing.
npm securitynewmeasuresstopnext
https://blog.risingstack.com/controlling-node-js-security-risk-npm-dependencies/
May 29, 2024 - Using npm packages inevitably exposes you to certain security risks. Follow these points to reduce your security exposure substantially.
node jscontrollingsecurityrisknpm
https://github.blog/changelog/2025-10-10-strengthening-npm-security-important-changes-to-authentication-and-token-management/
Sep 30, 2025 - As part of our ongoing commitment to securing the npm ecosystem, we’re implementing the first phase of security improvements outlined in our recent...
npm securityimportantchangesauthenticationtoken
https://libraries.io/npm/libraries.io
A libraries.io API client - 3.3.8 - a TypeScript package on npm
npm securitylibrariesio
https://changelog.com/friends/111
Over the past two months, we’ve seen some of the most serious supply chain attacks in npm history: phishing campaigns, maintainer account takeovers, and...
npmsiegefeaturing