Back Securityaffairs.Co

PackageGate bugs let attackers bypass protections in NPM, PNPM, VLT, and Bun

Securityaffairs.Co •Pierluigi Paganini • January 28, 2026

Koi researchers found “PackageGate” flaws in NPM, PNPM, VLT, and Bun that let attackers perform supply chain attacks and run malicious code. Security firm Koi uncovered a set of vulnerabilities collectively tracked as “PackageGate” affecting major JavaScript package managers like NPM, PNPM, VLT, and Bun. These flaws could let attackers bypass supply chain protections and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PackageGate Vulnerabilities Affect Major JavaScript Package Managers Koi researchers identified a set of vulnerabilities known as 'PackageGate' in NPM, PNPM, VLT, and Bun. These flaws allow attackers to bypass supply chain protections and execute malicious code, posing risks to users of these package managers. Microsoft has also issued emergency updates for a separate Office zero-day vulnerability, CVE-2026-21509. 2 sources 32

Extracted Entities

PackageGate bugs let attackers bypass protections in NPM, PNPM, VLT, and Bun

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (2)

Tools (2)

Vulnerabilities (1)