TAG
#npm
Stories connected through a shared idea, actor, technology or theme.
pnpm adds registry profile and token management commandsThe release adds pnpm profile and pnpm token commands for viewing, creating and revoking registry credentials. It also introduces a files-based store index for network filesystems and faster Python dependency resolution.→pnpm 12.8 warns about accidental environment-file publicationPackage packing and publishing now flag `.env` and `.env.*` files that are not explicitly listed in package metadata. The release also records pnpmfile checksums in pnpr lockfiles and avoids running unapproved build scripts while preparing certain git dependencies.→ChainDrop targets npm users through developer-tool configurationThe Register reports that ChainDrop poisoned 444 npm packages and can activate through configuration used by environments such as VS Code and Claude Code. The campaign is designed to harvest npm tokens, cloud credentials, and other secrets, while dependency scanning may not detect the configuration-based payload.→npm moves risky installation behaviour behind explicit approvalThe new defaults block preinstall, install and postinstall scripts, implicit node-gyp builds, Git dependencies and remote tarballs unless developers explicitly allow them. npm’s migration guidance uses project allowlists and also begins deprecating sensitive two-factor-authentication-bypass granular access tokens.→ChainDrop exposes persistence through Claude Code and VS Code configurationMicrosoft’s analysis describes more than 400 affected packages, a malicious preinstall payload, credential theft from developer and CI environments, and automated republishing through stolen npm access. The malware can also use GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, creating another path between compromised projects and developers.→