Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects
THE SO WHAT
Attackers moving upstream into packages like Keyv is another reminder that your real perimeter is npm, not prod. If you ship JavaScript, lock down dependency policies and add automated checks for package ownership and version anomalies this week.
READ THE SOURCE
MORE FROM THE WIRE
Deep & Emerging TechEVgo is putting 500 new fast chargers in the parking lots of American shopping centres
Fast chargers in 90+ shopping centers turn retail parking lots into energy and dwell-time infrastructure. Landlords, retailers, and grid operators should be modeling EV-driven foot traffic, load profiles, and pricing power — this is a new lever for both tenancy and ancillary revenue.
Deep & Emerging TechCaterpillar Surges as Data Center Boom Drives Growth
Data center demand is now visibly moving the needle for heavy equipment and power-generation vendors like Caterpillar — this is industrial, not just cloud, capex. If you depend on generators, switchgear, or backup power, expect longer lead times and higher prices as AI buildouts compete for the same hardware and skilled labor.
Deep & Emerging TechA worm tore through npm by making the malware look perfectly legitimate
ChainDrop shows how fragile the software supply chain is when a single registry compromise can poison hundreds of packages that everyone quietly depends on. Lock in provenance checks, pin versions, and treat your dependency tree as critical infrastructure — not a black box your build system blindly trusts.
Deep & Emerging TechMicrosoft warns hackers have compromised many hotel WiFi networks
Compromised hotel and hospitality WiFi means your executives’ travel habits are now a direct attack surface. Enforce VPN-by-default, discourage sensitive work on public networks, and treat hospitality connectivity as hostile until proven otherwise.