Microsoft says these 119 malicious extensions were downloaded a total of 2.6 million times since 2021.

The Wisconsin Badgers and Culver's have agreed to a jersey patch sponsorship deal. Culver's logo will appear on the football, men's basketball, and men's hockey uniforms starting in the 2026-27 season ...

With npm v12, GitHub closes a central attack vector: installation scripts from dependencies will only run after explicit approval from July 2026.

A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible ...

Vercel confirmed suffering a breach after a hacker claiming to be part of ShinyHunters offered to sell stolen data for $2 million. Vercel confirmed on Sunday that it has suffered an intrusion after a ...

If you think logo design is synonymous with branding, you are currently losing money. You are losing it to inefficient ad spend, to customer confusion, and to the inevitable “rebrand” you’ll have to ...

Strip the types and hotwire the HTML—and triple check your package security while you are at it. JavaScript in 2026 is just getting started. I am loath to inform you that the first month of 2026 has ...

A new campaign dubbed 'GhostPoster' is hiding JavaScript code in the image logo of malicious Firefox extensions with more than 50,000 downloads, to monitor browser activity and plant a backdoor. The ...

A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be exploited to execute code remotely through maliciously crafted input. The ...

What the Script: Supply chain attacks are traditionally designed to inflict maximum damage on structured organizations or companies. However, when such an attack compromises a supply chain that an ...