PackageGate bugs let attackers bypass protections in NPM, PNPM, VLT, and Bun

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PackageGate Vulnerabilities Affect Major JavaScript Package Managers Koi researchers identified a set of vulnerabilities known as 'PackageGate' in NPM, PNPM, VLT, and Bun. These flaws allow attackers to bypass supply chain protections and execute malicious code, posing risks to users of these package managers. Microsoft has also issued emergency updates for a separate Office zero-day vulnerability, CVE-2026-21509. 2 sources 32