Manifest Confusion Paves the Way to New npm Supply Chain Threats

A recent report by former npm engineering manager Darcy Clarke found that the npm registry does not validate manifest information against the contents of its corresponding package tarball. This creates a double source of truth that attackers can exploit to hide scripts or dependencies, says Clarke.

Over 100K+ Sites Hit by Polyfill.io Supply Chain Attack

E-Commerce security firm Sansec unveiled a new supply chain attack affecting the Polyfill JS service when accessed through a number of CDNs hosting it. According to Sansec, over 100K sites were hit. The original author of the service, Andrew Betts, suggested removing Polyfill from any sites using it.

How Airbnb Used LLMs to Accelerate Test Migration

Thanks to the right mix of workflow automation and large language models, Airbnb significantly accelerated the process of updating their codebase to adopt React Testing Library (RTL) and converted nearly 3.5K React test files originally using Enzyme.