Security alerts
What to fix right now.
Short alerts when a serious flaw hits sites like yours: what happened, who is affected, how to check your site and what to do. The important ones from the past year are here too, in case you missed them. Every alert cites its official sources.
Security alerts
August 2026
Shai-Hulud worm hits keyv and cache packages on npm: check and rotate keys
In August 2026, over 1,300 npm package versions, including keyv, were poisoned by a worm that steals developer credentials.
March 2026
Malicious axios versions on npm: check your projects and rotate keys
On March 31, 2026, axios 1.14.1 and 0.30.4 were published with malware. Machines that installed them are compromised.