Threat Brief — 2026-08-11 — 1,300 npm packages poisoned

A large-scale npm supply-chain poisoning campaign has struck approximately 1,300 packages, underscoring the persistent fragility of the JavaScript ecosystem's dependency chain. This is the single fresh finding from the last four hours; all other tracked stories remain in monitoring without new developments.

Top items

• npm supply-chain poisoning hits 1,300 packages. A coordinated attack has injected malicious code into roughly 1,300 npm packages, potentially affecting any project that pulls from the affected dependency tree. Engineers should audit lockfiles, pin trusted versions, and review any packages updated or added since the poisoning window began. No specific threat actor has yet been named. (src: anquanke)

Themes

Supply-chain integrity remains the dominant vector. This npm event joins a cluster of recent supply-chain compromises — including the BdThemes WordPress plugin hack and the 77 malicious Open VSX extensions — reinforcing that package registries across ecosystems (npm, WordPress, VS Code/Open VSX) are under sustained, parallel attack. Treat all dependency additions as untrusted until verified.