Loading today’s stories

Today

AI-assisted reporting, grounded in a per-article claim ledger. Perspective Coverage and Reality Strip separate source viewpoints from evidence, adoption, hype, incentives, and confidence.

Today

Front Page
Today’s Briefing
Newsletters
Trending
For You
Discover
My Stack
Saved
Off Radar
Search

Sections

Security
Build
Invest
Product
Leadership
Science

Company

About
Mission
How this is made
Evidence Index
The desks
The sources we read
Corrections
Press and brand
The daily edition

Trending now

H-1B Visa Policy
Israeli Tech Ecosystem
Agentic AI Risk
Teen online safety
Local-first AI agents
AI Copyright Litigation
Venture Funding Rounds
Strategic Corporate Investment
CTE Epidemiology
Sports Injury Liability

How this is made

Today For You My Stack Off Radar Search

Package Registry Abuse — Clarity Today

Topic

Package Registry Abuse

Use of npm and its mirrors as free, reputable storage and hosting for attacker content rather than as a code-execution vector.

Current clusters

security2 distinct publishers

npm as free hosting: 24 packages whose only job is rendering a fake Cloudflare page

OX Security says the packages were never meant to infect anyone who installs them. Mirrored through unpkg, they serve attacker HTML from a domain most egress policies wave through.

Publishers:bleepingcomputer.com · thehackernews.com

Reality

Evidence74
Adoption46
Hype gap+20
Incentives62

Confidence71