Security
ChainDrop: one hijacked maintainer account, 444 poisoned npm packages, four hours
On August 4 a worm that started in the keyv caching library spread to hundreds of packages with more than two billion combined monthly installs. Every malicious release had valid provenance.