Cyber Attacks
Block Compromised NPM Packages Before CVEs Are Published
Malicious code in trusted packages spreads before vulnerability databases flag threats, requiring detection at the moment of publication.
npm
Everything Shell Bulletin has reported about npm: 2 stories, newest first. Part of our Cyber Attacks coverage.
Vulnerabilities
Fix dot-access npm CVE-2026-107700 to prevent attackers from executing OS commands on Node.js servers
A critical flaw in the dot-access npm library allows attackers to run operating system commands on Node.js servers through crafted inputs.