# npm security

Published articles for npm security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Security Risks in Modern JavaScript Frameworks: React, Dependencies, and Client-Side Data Handling

DevFeed: [Security Risks in Modern JavaScript Frameworks: React, Dependencies, and Client-Side Data Handling](<https://devfeed.tech/articles/hidden-security-risks-in-modern-javascript-frameworks-17759.md>)

Original publisher: [Read original article](<https://talent500.com/blog/javascript-framework-security-risks-react-teams/>)

Author: snehaa

Published: 2026-06-10T09:09:52Z

Content type: article

Language: en

Sources: [Backend Archives | Talent500 blog](<https://devfeed.tech/sources/backend-archives-talent500-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [React](<https://devfeed.tech/topics/react.md>), [Web](<https://devfeed.tech/topics/web.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [backend](<https://devfeed.tech/tags/backend.md>), [csp](<https://devfeed.tech/tags/csp.md>), [framework-vulnerabilities](<https://devfeed.tech/tags/framework-vulnerabilities.md>), [frontend](<https://devfeed.tech/tags/frontend.md>), [frontend-security](<https://devfeed.tech/tags/frontend-security.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [javascript-security](<https://devfeed.tech/tags/javascript-security.md>), [newsletters](<https://devfeed.tech/tags/newsletters.md>), [npm-security](<https://devfeed.tech/tags/npm-security.md>), [react](<https://devfeed.tech/tags/react.md>), [react-security](<https://devfeed.tech/tags/react-security.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [technology](<https://devfeed.tech/tags/technology.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [xss](<https://devfeed.tech/tags/xss.md>)

### AI overview

The article examines security risks in modern JavaScript applications, focusing on React data handling, dangerous DOM sinks, dependency supply-chain complexity, and configuration issues that can contribute to XSS, injection, data leakage, and vulnerable code reaching production.

### Source excerpt

Modern JavaScript frameworks have transformed how web applications are built, but they have also introduced new, less visible security risks. [...] The post Hidden Security Risks in Modern JavaScript Frameworks appeared first on Talent500 blog.

## Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp

DevFeed: [Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp](<https://devfeed.tech/articles/miasma-phantom-gyp-npm-attack-57-packages-286-malicious-versions-hijack-ci-cd-pipelines-via-binding-gyp-12928.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack>)

Published: 2026-06-05T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Security](<https://devfeed.tech/topics/security.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [npm](<https://devfeed.tech/topics/npm.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [malware](<https://devfeed.tech/tags/malware.md>), [miasma](<https://devfeed.tech/tags/miasma.md>), [npm-security](<https://devfeed.tech/tags/npm-security.md>), [packages](<https://devfeed.tech/tags/packages.md>), [phantom-gyp](<https://devfeed.tech/tags/phantom-gyp.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

This article describes the Miasma Phantom Gyp npm supply-chain attack, in which attackers published 286 malicious versions across 57 packages. The self-replicating worm targeted CI/CD pipelines, harvested credentials, poisoned additional packages, modified workflows, and planted backdoor configurations in AI coding assistant directories. It also explains that Chainguard customers were protected because Chainguard Libraries builds from source and blocked the malicious versions.

### Source excerpt

A new npm supply chain worm compromised 57 packages and 286 versions. Learn how Chainguard blocked the attack and protected customers by design.