
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Highly experimental tool to help locate a regression in a project caused by a new version of a direct or indirect dependency. Insipired by `git bisect`.
Highly experimental tool to help locate a regression in a project caused by a
new version of a direct or indirect dependency. Insipired by git bisect.
npm install -g npm-bisect
Options:
--help Show help [boolean]
--version Show version number [boolean]
--debug Produce verbose output for each step [boolean] [default: false]
--yarn Use yarn instead of npm [boolean] [default: false]
--run Shell command to run for each step. Will use interactive mode if
not given [string]
--ignore Name of a package to ignore. Can be repeated [array] [default: []]
--good Date or datetime where the project was last known to work [string]
--bad Date or datetime where the project was first found broken [string]
FAQs
Highly experimental tool to help locate a regression in a project caused by a new version of a direct or indirect dependency. Insipired by `git bisect`.
We found that npm-bisect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.