Everything Vuln Post has reported about npm: 4 stories, newest first. Part of our Vulnerabilities coverage.
A flaw in follow-redirects versions 1.16.0 up to 1.16.1 allows sensitive headers with specific characters to leak during cross-origin redirects. Version 1.16.1 patches the issue.
A high-severity flaw in OpenNextJS Cloudflare allows attackers to bypass middleware authorization by exploiting inconsistent path decoding in cached routes.
Bloom Security found over 1,500 npm packages vulnerable to a publishing attack that could allow AI agents to install malicious code without credential theft.
The credential-stealing Shai-Hulud worm expanded its reach to AI tools by infecting the Tensorlake package on npm, with detection occurring within minutes of the malicious release.