replacements.fyi - performant, safer npm package alternatives

npmx - Package Browser for the npm Registry

a fast, modern browser for the npm registry. Search, browse, and explore packages with a modern interface.

Popular npm Packages in the keyv and Cacheable Namespaces Co...

Popular npm packages keyv and cacheable compromised.

npmx-dev/npmx.dev

a fast, modern browser for the npm registry

npm install-time security and GAT bypass2fa deprecation - GitHub Changelog

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

npmx.dev/npmx.dev

[READ-ONLY] a fast, modern browser for the npm registry

keyv and cacheable npm Package Hijacked in Supply Chain Attack | Wiz Blog

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.

teardown

Find the cost of adding an npm package to your app's bundle size.

atpkgs

Atpkgs is compatible with the NPM Registry API, so it works with most Node.js package managers.

@w1c - npmx

npm packages published by the w1c organization

Just Fucking Use Go - Blain Smith

Hey, dipshit. You know what compiles in two seconds, deploys as a single binary, and doesn't shit itself when a transitive dependency gets yanked from npm at 3am? Go. The same way HTML has been sitting there since the dawn of the goddamn internet waiting for you to stop overcomplicating the frontend, Go has been sitting there for over a decade waiting for you to stop overcomplicating the backend.

The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

package.json | npm Docs

Specifics of npm's package.json handling

npm Worm Poisons keyv, cacheable and 400+ Other Packages Across Twelve Organisations

A worm moved one byte-identical credential stealer through more than 400 npm packages in twelve organisations on 4 August 2026, including @ornikar, @deliveroo, @servicetitan, @qlik, Picsart and the keyv and cacheable family. latest still resolves to a poisoned version on most affected names, and the payload installs a dead-man switch that fires when the stolen GitHub token is revoked, so rotating credentials first triggers it.

Inside the keyv npm Supply Chain Compromise | Snyk

The keyv npm compromise used preinstall malware, trusted provenance, and IDE hooks to target developer and CI credentials. Learn how to detect and respond.