Maintainers of the npm registry for JavaScript code have recently identified what appeared to be a software supply-chain attack that took advantage of the nested dependency model of Node.js modules. After being notified by members of the development community, the npm security team recently began investigating three suspicious packages and one of them turned out to include a backdoor or a secret entranceway unbeknownst by users.

Read full news article on The New Stack