npm

Everything CloudSec Press has reported about npm: 2 stories, newest first. Part of our Vulnerabilities coverage.

16 Oct
Vulnerabilities

Does Your TanStack Start App Let Attackers Inject Scripts via Server Functions?

A critical cross-site scripting flaw in TanStack Router allows unauthenticated attackers to inject scripts. Patches are available for affected npm packages.

13 Oct
Vulnerabilities

How npm Trusted Publishing Slug Reuse Enabled Package Takeovers

Researchers showed that attackers could hijack npm packages by claiming abandoned GitHub repository names, exposing over 1,500 packages to unauthorized updates.