The npm Threat Landscape: Attack Surface and Mitigations

Reported 25 Apr 2026 by otx · Severity: medium

The npm ecosystem experienced a critical shift in September 2025 with the Shai-Hulud worm, marking the transition from isolated attacks to systematic supply chain compromises. In April 2026, TeamPCP launched a coordinated campaign through a malicious @bitwarden/cli package target