Vulnerabilities
npm launch-editor and Vite Command Injection on Windows via Path Suffix Bypass
Attackers can bypass file existence checks in npm packages to inject OS commands on Windows systems using crafted path suffixes.
Read morenpm
Everything BlueTeam Insider has reported about npm: 3 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
npm MCP Server CVE-2026-111770 Cross-Client Data Leak in Shared HTTP Instances
A high-severity vulnerability in the npm Model Context Protocol server allows cross-client data leakage when multiple clients share a single server instance over HTTP.
Read more
Vulnerabilities
npm Trusted Publishing Slug Validation Gap Exposed Thousands of Packages
Researchers found that abandoned GitHub repository names allowed attackers to hijack publishing rights for over 1,500 npm packages, a flaw now patched.
Read more