# javascript packages

Published articles for javascript packages.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks

DevFeed: [npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks](<https://devfeed.tech/articles/npm-s-update-to-harden-their-supply-chain-and-points-to-consider-13191.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/npm-update-to-harden-their-supply-chain-and-points-to-consider>)

Published: 2026-02-03T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [javascript-packages](<https://devfeed.tech/tags/javascript-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [npm](<https://devfeed.tech/tags/npm.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

The article examines npm's authentication overhaul after the Sha1-Hulud incident. It explains that short-lived session tokens, default MFA for publishing, and OIDC Trusted Publishing improve security, but MFA phishing and optional 90-day tokens with MFA bypass still leave projects vulnerable to supply-chain attacks.

### Source excerpt

npm's token changes help, but MFA phishing and optional bypass tokens still enable supply-chain attacks. Source-built Chainguard Libraries reduce the risk.

## Building an npm package compatible with ESM and CJS in 2024

DevFeed: [Building an npm package compatible with ESM and CJS in 2024](<https://devfeed.tech/articles/building-an-npm-package-compatible-with-esm-and-cjs-in-2024-7854.md>)

Original publisher: [Read original article](<https://snyk.io/blog/building-npm-package-compatible-with-esm-and-cjs-2024/>)

Author: Liran Tal

Published: 2024-04-18T17:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [ECMAScript](<https://devfeed.tech/topics/ecmascript.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Code](<https://devfeed.tech/topics/code.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [blog](<https://devfeed.tech/tags/blog.md>), [commonjs](<https://devfeed.tech/tags/commonjs.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [github](<https://devfeed.tech/tags/github.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [javascript-packages](<https://devfeed.tech/tags/javascript-packages.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm](<https://devfeed.tech/tags/npm.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

### AI overview

This article explains how to publish npm packages that support both ECMAScript Modules (ESM) and CommonJS (CJS). It discusses package manifest fields, entry-point resolution, TypeScript integration, and practical compatibility considerations, with code examples and a referenced GitHub repository.

### Source excerpt

Publishing JavaScript packages that are compatible with both ECMAScript Modules (ESM) and CommonJS (CJS) is a critical skill for developers who aim to integrate wide-ranging libraries. This write-up focuses on practical approaches and best practices for maintaining ESM and CJS support.