a Futurum companyTag
10 articles
Sponsored Content
March 2026: malicious versions of axios get published directly to npm. May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shipped before detection. August 2026: a worm uses one m…
Showing 1–10 of 10
DevOps and Open Technologies
For years, one of the easiest ways to sneak malware onto a developer’s machine has been to hide in plain sight. Install a package from npm, and any lifecycle script bundled with it…
Blogs
For years, running npm install meant trusting that whatever code got pulled in would behave itself. That trust was often misplaced. Starting in July 2026, npm v12 changes the rules…
Blogs
A malicious package downloaded approximately 50,000 times from a node package manager (npm) is providing an object lesson for adopting more DevSecOps best practices. Security resea…
DataOps
North Korea’s notorious Lazarus Group is using an advanced malicious implant to target cryptocurrency wallets and spreading it via legitimate GitHub profile and possibly through np…
Blogs
A Checkmarx report details an ‘Everything’ package distributed via the NPM registry that cripples any machine used to download it.
Blogs
In this week’s #TheLongView: The npm registry suffers spam infestation, and Microsoft makes Google sad.
Blogs
Building applications in the NPM development life cycle can be very complex. Let’s review the main factors that contribute to this complexity: An endless number of variables: Build…
Blogs
One of the three “ways”—or principles that DevOps guru Gene Kim articulates as defining DevOps—is amplifying feedback loops. One of the key ways that Ops contributes to this amplif…
Blogs
Welcome to To Be Continuous, a show about continuous delivery and software development, hosted by Heavybit members Paul Biggar, founder of CircleCI, and Edith Harbaugh, CEO of Laun…
