2026-08-04T17:06:21Z https://nostr.now Markus Tacker https://nostr.now/npub10rsvp26shue08py7cj9ckv56h9z0rwhpq66advnx89nv6d99x8gqsnhvyf https://assets.chaos.social/accounts/avatars/109/244/691/086/010/003/original/c4313170aad7957c.jpg https://assets.chaos.social/accounts/avatars/109/244/691/086/010/003/original/c4313170aad7957c.jpg https://nostr.now/nevent1qqsgcqqd0dquctcard0m70ah8uke5yx2rga65ddkk3ysc49yz5rjx3szypuwps9t2zln9uuynmzghzejn2u5fud6uyrtt44jvcukdnf555caquenryn That&#39;s why you should migrate to #NPM v12, it prevents exactly this kind of attack: <a href="https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack">https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack</a><br/><br/>&gt; Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a &#34;preinstall&#34;: &#34;node setup.mjs&#34; entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed. 2026-08-04T16:33:16Z