Post

⚠️ SECURITY ALERT: An npm dependency used by Web Awesome was compromised a few hours ago. This ONLY affects npm installs — CDN users are safe. DO NOT install Web Awesome via npm right now. New unaffected version is publishing now…

Web Awesome

@webawesome.com

15 Sept 2025

Details on the affected dependency can be found here: t.co/pvhIvAA7N1

t.cohttp://socket.dev/npm/package/@ctrl/tinycolor/overview/4.1.2

Web Awesome

@webawesome.com

bsky.app/profile/sock...

Socket@socket.dev

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

15/9/25, 11:34 pm0 reposts1 like

Web Awesome

@webawesome.com

15 Sept 2025

Update: bsky.app/profile/weba...

Web Awesome@webawesome.com

Web Awesome 3.0.0-beta.6 has just been published to npm. This version is safe to use, as it pins the affected dependency to the last safe version. You can update to 3.0.0-beta.6 by running the following command: npm i @awesome.me/webawesome@3.0.0-beta.6