javascript

A dormant malicious script planted on Russian Wikipedia in 2024 was inadvertently activated during a Wikimedia security review, modifying thousands of pages and 85 user scripts before engineers locked down editing across all projects.

Deno 2.7 ships stable Temporal date/time API, official Windows ARM builds, npm overrides, and over 40 Node.js compatibility fixes in its February 25 release.

Node.js published versions 25.6.0, 25.6.1, and 25.7.0 across February 2026, advancing built-in SQLite to release-candidate status, extending Single Executable Applications to ESM entry points, and adding SIMD-accelerated text encoding.

Researchers say Git-sourced dependencies can re-enable code execution paths even when npm is run with --ignore-scripts, undermining a widely recommended mitigation after 2025’s Shai-Hulud worm.