The maintainer account for the axios package on npm was compromised to inject a remote access trojan for Windows, macOS, and ...

MCP is the MVP.

An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions ...

On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages ...

UltraJSON's architecture is fundamentally ill-suited to making changes without risk of introducing new security vulnerabilities. As a result, this library has been put into a maintenance-only mode.

Additionally, it includes a heavily customized fork of msgpack-numpy, with corrected round-trip behaviour for np.float64 objects. This will automatically install/upgrade all dependencies. numpy and ...