It's been some weeks with npm exploits. But there is a fix, Deno's limited permissions can help here.
https://deno.com/blog/deno-protects-npm-exploits
npm
Introducing #Upyo!
A simple, cross-runtime email library that works seamlessly on #Deno, #Node.js, #Bun, and edge functions. Zero dependencies, unified API, and excellent testability with built-in mock transport.
Switch between #SMTP, #Mailgun, #SendGrid without changing your code. Available on #JSR & #npm!
#Axios #npm Package Compromised: Supply Chain Attack Delivers Cross-Platform #RAT
https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/
Been getting these random #npm issues lately 😕
Scenario: dependency has optional peer dep that installs pre-built binaries based on current OS. I npm install it on macOS, it gets the macOS binaries & put it as non-optional dep in package-lock.json. CI runs on Linux, it got confused & failed installation. And npm ci doesn't skip incompatible peer deps.
Relevant issues:
- https://github.com/npm/cli/issues/7750 (2024, closed, continued in other issues/PRs)
- https://github.com/npm/cli/issues/8464 (regression since 2025)