Published on
May 30, 2025
Package lurking in npm for six years waits to destroy your work
Socket’s threat researchers have uncovered a package lurking in npm for six years that awaits a remote command to wipe projects. The culprit? A package called xlsx-to-json-lh, which mimics the legitimate xlsx-to-json-lc package. Notice the difference? Just …
Source:
Developer Tech News
-
Pending
