platform
npm: security advisories, deprecations and releases
The npm registry and package manager for JavaScript.
- Items, 90 days
- 4
- Critical
- 0
- Last critical
- none
- This week
- 0
Security 2
- HIGH OpenSSF Blog · 17 Oct 2026
GitHub expands malware advisories to eight ecosystems via OpenSSF
GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.
- HIGH GitHub Changelog · 5 Oct 2026
Unvalidated npm trusted publishing configurations now expire
Unvalidated npm trusted publishing setups now expire after 48 hours and lose publishing rights, reducing risk from repository ownership changes.
Releases 2
- INFO GitHub Changelog · 20 Oct 2026
Dependabot now supports npm 12, pnpm 11/12, and Bun 1.4
Dependabot now supports the latest package manager versions: npm 12, pnpm 11/12, and Bun 1.4 for GitHub.com and GitHub Enterprise Server 3.24.
- INFO GitHub Changelog · 5 Oct 2026
npm staged publishing now supports creating new packages
npm stage publish can now create new public or private scoped packages and public unscoped packages from automated workflows without a manual first publish.
Only hear about npm when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.