Utopia Tech
▸ Engineering & Strategy Journal

Field notes from the edge.

What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.

All postsHealthcareEngineeringStrategySecurityIndustry
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
FeaturedAI
Security· 1 min read

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub is implementing breaking changes in npm version 12 that will disable install scripts by default as a security measure against supply chain attacks. This change specifically targets malicious actors who exploit npm lifecycle hooks to execute harmful code during the package installation process.

UT
Utopia Tech·Jun 11, 2026
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain AttacksAI
Security

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

The npm ecosystem has been targeted by multiple supply chain attacks involving over 50 compromised packages. Threat actors deployed IronWorm, a Rust-based information stealer that uses eBPF kernel rootkit techniques to hide while harvesting credentials, and a new variant of the Miasma worm capable of self-propagation across developer environments.

UTUtopia Tech·1 min
Rust-Written IronWorm Hits NPM Supply ChainAI
Security

Rust-Written IronWorm Hits NPM Supply Chain

A new malware campaign called IronWorm, written in Rust, has been discovered targeting the NPM package ecosystem. The malware focuses on compromising developer credentials and leveraging them to spread laterally across the software supply chain, posing significant risks to enterprise development environments.

UTUtopia Tech·1 min
Skip to main content