Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.

Fifteen DeFi exploits had already been logged by late March 2026, according to CoinPaprika’s 2026 exploit tracker, and the pace hasn’t slowed since: CertiK’s H1 2026 report counted 344 incidents and ...