npm

The most widely used online repository for Node.js projects.

Spam-pm: Investigating the Spam Invasion of npm
A deep dive into escalating spam problem on npm, and exploring the registry's unwanted guests.
Published by Garnet Research (@research)
By
Date
April 4, 2023
Reading time
· 7 min
Read more
From Confusion to Compromise: Dependency Confusion Attacks
A primer on dependency confusion attacks
Published by Garnet Research (@research)
By
Date
January 10, 2023
Reading time
· 4 min
Read more
Super Dependence In Modern Software
A primer on transitive dependencies in open source software and how it results in super dependence.
Published by Farrukh Jadoon (@fkj) and Umar Sikander (@us)

By and
Date
November 1, 2022
Reading time
· 9 min
Read more
All your domains are belong to us
Let's discuss one of the most underrated but effective attack vectors: using expiring domains to take over npm packages.
Published by Garnet Research (@research)
By
Date
October 4, 2022
Reading time
· 10 min
Read more
The worst fear of a JavaScript developer
A discussion on the risks of transitive dependencies in JavaScript.
Published by Farrukh Jadoon (@fkj) and Umar Sikander (@us)

By and
Date
October 4, 2022
Reading time
· 7 min
Read more