JavaScript, Nodejs, Security, NPM.
transitively affect 54% of the overall npm ecosystem! Had the researcher published a patch release for each package he controlled, then running an npm install with a dependency tree containing any of those 54% of packages would result in executing the researcher’s code. The important takeaway is