Another npm supply chain attack. Hopefully npm will add measures to make installing packages safe(r) again. pnpm has already added one (*).
https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages
(*) https://github.com/pnpm/pnpm/releases/tag/v10.16.0
Axel Rauschmayer
npub10f…ardvy
2025-09-16 00:05:34 UTC
Author Public Key
npub10faqj7xvgmhhl42glvf9u5wqfhnafjnrjst6yx6k4227xugupvuqzardvySeen on
wss://relay.momostr.pinkPublished at
2025-09-16 00:05:34 UTCEvent JSON
{
"id": "5c9432a16f055b699f062f89f0ccb711aea8825499f63cbedb4a3da2c086f4e3",
"pubkey": "7a7a0978cc46ef7fd548fb125e51c04de7d4ca639417a21b56aa95e3711c0b38",
"created_at": 1757981134,
"kind": 1,
"tags": [
[
"proxy",
"https://fosstodon.org/@rauschma/115211051655536844",
"web"
],
[
"proxy",
"https://fosstodon.org/users/rauschma/statuses/115211051655536844",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://fosstodon.org/users/rauschma/statuses/115211051655536844",
"pink.momostr"
],
[
"-"
]
],
"content": "Another npm supply chain attack. Hopefully npm will add measures to make installing packages safe(r) again. pnpm has already added one (*).\nhttps://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages\n\n(*) https://github.com/pnpm/pnpm/releases/tag/v10.16.0",
"sig": "4e1bf1b87438389e795650a446f6d9bd14551d778bc3565971f2054ac2325973ef5c4e99252b55b20b6985c70b7444534c7449cfb3306b4d6c99f1cb61d8afb2"
}