Record · corpus.blog/posts/01a08755-6ceb-722c-901b-fde09676c2c0

Blocking Install Scripts Is Not a Silver Bullet

nodesource.com · published 19 June 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at nodesource.com Wayback capture

1blogs citing

First cited: 1 Jul 2026
Most recent: 1 Jul 2026
Rank this month: not ranked
Links from this post: 21
Words captured: 3,820

Cited by

Blog

In the post

Date

blog.ulisesgascon.com

Newsletter #015: A Break from Survival Mode 🥹 Read at the source ↗

1 Jul 2026

Links from this post

Link

Host

https://cna.openjsf.org/

cna.openjsf.org

Announcing the Node.js AI Security Engineer in Residence Read at the source ↗

alpha-omega.dev

https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

github.blog

https://pnpm.io/supply-chain-security

pnpm.io

https://www.splunk.com/en_us/blog/security/npm-supply-chain-attack-detection-analysis.html

splunk.com

https://www.sonatype.com/blog/ongoing-npm-software-supply-chain-attack-exposes-new-risks

sonatype.com

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26) Read at the source ↗

unit42.paloaltonetworks.com

https://advisories.gitlab.com/pkg/npm/posthog-js/

advisories.gitlab.com

600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm Read at the source ↗

ox.security

IronWorm Supply Chain Malware Hits npm Read at the source ↗

ox.security

https://developer.mozilla.org/en-US/docs/Glossary/IIFE

developer.mozilla.org

Node.js Official Threat Model Read at the source ↗

github.com

What is a backdoor? Let’s build one with Node.js Read at the source ↗

snyk.io

https://nodejs.org/api/permissions.html

nodejs.org

https://nodejs.org/api/cli.html

nodejs.org

Tuesday, January 13, 2026 Security Releases Read at the source ↗

nodejs.org

https://github.com/step-security/harden-runner

github.com

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

stepsecurity.io

https://www.stepsecurity.io/blog/how-harden-runner-detected-the-sha1-hulud-supply-chain-attack-in-cncfs-backstage-repository

stepsecurity.io

https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

stepsecurity.io

https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised

stepsecurity.io