NPM stands for Node Package Manager, which is an application and repository for developing and sharing JavaScript code. To publish and install packages to and from the public NPM registry or a private NPM registry, you must install Node.js and the NPM command line interface using either a Node version manager or a Node installer.
Within a single day, several unrelated security problems came to light and kept security teams occupied. PHP disclosed two critical remote code execution flaws, Node.js released a security update fixing four high-severity issues, a malicious LiteLLM version showed up in public package and container registries, and an Indian certificate authority was found to have eight intermediate keys that anyone could guess. Every one of these problems affects a different layer of the stack, and seeing them together shows how many points of exposure a single server or container image can have at once.
