Cybersecurity
Six Vulnerabilities in Major JavaScript Package Managers Expose Projects to Supply-Chain RCE
Security firm Koi disclosed six vulnerabilities across NPM, PNPM, VLT, and Bun that let attackers bypass common install-time protections and potentially achieve remote code execution. PNPM, VLT and Bun issued fixes quickly while NPM declined to change the behavior, leaving many projects exposed if they rely on Git or tarball dependencies without added protections.