Post

Web Awesome
@webawesome.com

⚠️ SECURITY ALERT: An npm dependency used by Web Awesome was compromised a few hours ago. This ONLY affects npm installs — CDN users are safe. DO NOT install Web Awesome via npm right now. New unaffected version is publishing now…

3 reposts6 likes

Web Awesome
@webawesome.com

bsky.app/profile/sock...

Socket@socket.dev

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

socket.devPopular Tinycolor npm Package Compromised in Supply Chain At...Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers