chiprook
← Security
SecurityOctober 26, 2026, 21:56

npm metadata exposes 53 real maintainer emails for the ms package

A single unauthenticated GET to registry.npmjs.org/ms/latest returns 53 real maintainer email addresses, including corporate @vercel.com and @google.com ones. webpack lists 8 and typescript 7; PyPI exposes emails too, while crates.io has no email fields in its index.

npm metadata exposes 53 real maintainer emails for the ms package
#Npm#PyPI#Crates.io
Read next
Security

Omnis Watchtower: a Claude Code plugin that vets packages before install

Security

phantom-deps scans AI-generated code for hallucinated packages

Security

MemTensor packages poisoned: AI memory plugin steals developer credentials

Security

Slopsquatting: AI agents install packages attackers registered in advance