Node js and JavaScript 

Share

Latest news on Node.js and JavaScript, covering Node.js security releases, Node.js vulnerabilities and CVEs, npm supply chain attacks, malicious npm packages, TypeScript, React, Next.js, Express, Deno, Bun, ECMAScript and the OpenJS Foundation, plus Node.js LTS, npm install worms and JavaScript framework updates for developers.

Node.js is a free, open-source runtime that lets developers run JavaScript on servers and command-line tools, not only in web browsers. It was created by Ryan Dahl in 2009 and is built on Chrome's V8 engine. Its package manager, npm, gives projects access to a vast public registry of open-source packages.

Supply chain security is a major recurring theme. Attackers publish malicious packages or hijack maintainer accounts to steal credentials and spread to other projects, as the self-replicating Shai-Hulud worm did from September 2025. In October 2026 researchers reported a flaw in npm trusted publishing that exposed more than 1,500 packages to takeover, and a Node.js security release fixed ten vulnerabilities, including a Brotli decoder flaw.

Developers build on a wide ecosystem. Frameworks include React, Next.js, Vue, Angular, Svelte and Express, while TypeScript adds static typing and compiles to plain JavaScript. Alternative runtimes such as Deno and Bun compete on built-in tooling, and Cloudflare agreed to acquire Deno in October 2026.

The OpenJS Foundation, formed in 2019 by merging the Node.js Foundation and the JS Foundation, hosts Node.js and other projects alongside volunteer maintainers. Critics point to dependency sprawl, where one application can pull in hundreds of small packages, and to the workload of unpaid maintainers. Ownership of the JavaScript trademark also draws debate, and Deno's developers petitioned the US trademark office in November 2024 over Oracle's mark.

JavaScript was created by Brendan Eich at Netscape in 1995 and later standardised as ECMAScript. Node.js followed in 2009, and a 2014 governance dispute produced the io.js fork, which rejoined the project in 2015. In March 2016 the removal of a tiny package called left-pad briefly broke builds worldwide, showing how much software depends on small modules.

Our NewsNow Node.js and JavaScript news feed brings together the latest headlines on Node.js security, npm supply chain attacks, TypeScript, React, Next.js, Deno, Bun and the wider JavaScript ecosystem from reliable sources worldwide, giving developers and security teams one up-to-date view.