Tagged

Node.js

Supply-chain attacks and security guidance for Node.js and npm projects, including malicious packages and how to audit dependencies.

1 post

October 26, 2026 · 6 min read

MALFEX: eight malicious npm packages, three payloads, and why --ignore-scripts isn't enough

A single operator spent three years publishing malicious npm packages that delivered a remote access trojan and a credential stealer to Windows developers. How MALFEX worked, which packages were involved, and how to check your own projects.

Cybersecurity

Node.js