JavaScript

Unplugged holes in npm and yarn could let attackers bypass Shai-Hulud defenses

A researcher at Koi Security says the two key platforms have not plugged the vulnerabilities enabling the worm attacks, and ‘the JavaScript ecosystem deserves better.’