Attackers Are Hunting High-Impact Node.js Maintainers in a C...

A coordinated phishing campaign is targeting high-impact open source maintainers. Plus: Scorecard v6 evolving into a security evidence engine, 12 CVEs patched across undici, fastify, path-to-regexp and lodash, and a conversation about Node.js in production.

Unmasking the risky illusion of npm's "trusted publishing" amidst recent cyber attacks.

Understanding npm and the importance of dependency cooldowns.