See the full list of npm packages compromised in the "SHA1-Hulud npm supply chain incident – Nov 2025" [View compromised packages].
flavio vulnerabilities
Really simple package manager for your own private packages hosted on any git or svn server. No registry or server hosting required. Can be used in conjunction with bower/npm