AI Briefing#npm
The latest AI and developer news about #npm, with the original source and a short summary.
The latest AI and developer news about #npm, with the original source and a short summary.
The feature keeps tokens outside the sandbox while allowing coding agents to install dependencies from private registries like GitHub Packages and JFrog Artifactory.
The protection applies automatically to new builds on all plans with no configuration required, failing deployments if a blocked dependency is detected.
Vercel Agent now supports installing private dependencies from npm and custom registries using credentials stored as shared environment variables.
v0 now supports installing private npm packages and custom registries through Vercel's shared environment variables.
Vercel has built a software factory to automate the handling of issues and PRs for the AI SDK.
Web Three Slicer slices 3D models directly in the browser without requiring a server or installation.
GitHub has introduced new security measures to defend against supply chain attacks targeting npm and GitHub Actions.
GitHub Dependabot has introduced a cooldown feature by default that delays PR creation for at least 3 days after a new release, in response to supply chain attacks.
Extensions that package tools, hooks, skills, and more for the eve agent can now be distributed and installed via package registries like npm.
Using the Axios case as an example, this article analyzes the risks of software supply-chain attacks and presents a defense strategy leveraging pnpm.
A malicious npm package that steals local files from Claude AI users has been discovered via GitHub.
The original author of the AI agent tool GSD abandoned the project and carried out a coin scam, creating a security risk.
An npm package supply chain attack has been discovered that risks hijacking AI coding tools such as Claude Code and Codex.
OpenAI announced its response to the TanStack npm supply chain attack and a macOS certificate replacement.
The npm package @bitwarden/cli 2026.4.0 has been poisoned by the Checkmarx supply chain attack.
A supply chain attack stealing developer secrets was discovered in a fake package impersonating @bitwarden/cli.
This is a hands-on tip claiming that forcibly installing a specific Claude Code version activates Opus 4.7.
If the gateway won't come up after the 4.14 update, suspect a tangled entrypoint path.
A centralized upload queue is safer and more consistent than distributed dependency cooldowns.
With just an npm install and GitHub login, you can start using Copilot right in your terminal.
It points out the security risk that `npx -y ...@latest` automatically runs new npm code on every session, and suggests switching to a pinned-version local execution instead.
GitHub is strengthening open source supply chain security, focusing on GitHub Actions and npm.
es-toolkit is an ES Modules- and TypeScript-based utility library that replaces lodash.
A supply chain attack was discovered in the npm **axios** package, requiring security measures for users of certain versions.