npm and Node.js supply-chain and package advisories: worms, hijacked maintainers, malicious install scripts.
Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.
A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.
Poisoned TanStack packages stole an Nx developer’s GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.
A hijacked maintainer account published axios 1.14.1 and 0.30.4 with a dependency that installs a remote access trojan. Check lockfiles for plain-crypto-js.
An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.
A self-replicating npm worm runs at install time, steals developer and CI secrets, and registers rogue GitHub runners. New waves hit from April to August 2026.
