NPM ecosystem at risk from “Manifest Confusion” attacks

The NPM (Node Package Manager) registry suffers from a security lapse called "manifest confusion," which undermines the trustworthiness of packages and makes it possible for attackers to hide malware in dependencies or perform malicious script execution during installation. [...]

attackers attacks called dependencies ecosystem hide installation lapse malicious malware manager manifest node node package manager npm package package manager packages registry risk script security trustworthiness