DEV Community

npm

Node Package Manager

Posts

👋 Sign in for the ability to sort posts by relevant, latest, or top.
Two npm Bugs, One Lesson: Upgrading the Runtime Is Not Upgrading the Dependencies

Two npm Bugs, One Lesson: Upgrading the Runtime Is Not Upgrading the Dependencies

Comments 1
4 min read
The fast-jwt fix for algorithm confusion missed the prefix

The fast-jwt fix for algorithm confusion missed the prefix

Comments
5 min read
OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole

OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole

Comments
15 min read
Two Worms, One Blind Spot

Two Worms, One Blind Spot

Comments
3 min read
How npm worms steal your credentials, and the order to rotate them in

How npm worms steal your credentials, and the order to rotate them in

Comments 1
7 min read
Is this project npm, pnpm, Yarn 1 or Yarn 4? How to tell, and why Yarn is the tricky one

Is this project npm, pnpm, Yarn 1 or Yarn 4? How to tell, and why Yarn is the tricky one

Comments
4 min read
10 TypeScript files, 5 SDK artefacts: typed in Node and Deno

10 TypeScript files, 5 SDK artefacts: typed in Node and Deno

Comments
5 min read
I checked 26 popular Node.js starters. 18 ship a high-severity vulnerability that npm update can't fix

I checked 26 popular Node.js starters. 18 ship a high-severity vulnerability that npm update can't fix

Comments
6 min read
Your Coding Agent Added an npm Package. 6 Commands to Vet It Before You Land the Branch

Your Coding Agent Added an npm Package. 6 Commands to Vet It Before You Land the Branch

1
Comments
8 min read
Securing your pnpm supply chain

Securing your pnpm supply chain

Comments
2 min read
The Nx Malware Ran Claude Code With --dangerously-skip-permissions. Could It on Yours?

The Nx Malware Ran Claude Code With --dangerously-skip-permissions. Could It on Yours?

Comments
8 min read
The 60-Second Check Before Every npm install

The 60-Second Check Before Every npm install

Comments
4 min read
When npmjs is flaky in China: switch to a team registry with PROXY cache

When npmjs is flaky in China: switch to a team registry with PROXY cache

Comments
5 min read
Start a free cloud npm private registry: from publish to public distribution

Start a free cloud npm private registry: from publish to public distribution

Comments
6 min read
I Found a Fourth Package Registry My Sandbox Could Reach. It Checksums Every File, Not Just the Tarball.

I Found a Fourth Package Registry My Sandbox Could Reach. It Checksums Every File, Not Just the Tarball.

Comments
6 min read
👋 Sign in for the ability to sort posts by relevant, latest, or top.