vlt /vōlt/ (@vltpkg) / X

vlt /vōlt/

148 posts

vlt /vōlt/

@vltpkg

JavaScript package registries & tooling for teams that move fast.

Joined March 2023

vlt /vōlt/
@vltpkg
6h
Last month Drizzle ORM couldn't publish a new release to npm for weeks. Not a bug in their code. Their metadata file crossed npm's 100 MB limit, & the only fix was asking npm support to delete old versions by hand. 🧵
vlt /vōlt/
@vltpkg
Jul 29
18 malicious npm packages posed as Alibaba's private internal tooling to slip a cross-platform RAT onto its own developers' machines. The final payload even pulled from Alibaba Cloud to blend in.
Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers
From cybersecuritynews.com
vlt /vōlt/
@vltpkg
Jul 28
Your AI assistant just suggested an npm package. It looks real, it's well-named, it solves your exact problem. It also never existed until an attacker registered the name & filled it with malware. That's slopsquatting. 🧵
vlt /vōlt/
@vltpkg
Jul 27
Developers beware! A fake version of corepack has reared its head again at corepack(dot)org The only spot you'll get the faithful package is global install through npm or vlt ;)
itnews.com.au
Fake Corepack tool site goes quiet after luring devs with malware
Dropped infostealer and proxy-hijacking software.
vlt /vōlt/
@vltpkg
Jul 26
The average node_modules has more contributors than most companies have employees. We just never see their faces.
See @vltpkg's full profile
Sign up
Log in

See @vltpkg's full profile