A major cybersecurity discovery is raising new concerns about the security of software downloaded by millions of developers and AI agents worldwide.

Researchers at Bloom Security have uncovered a critical vulnerability in npm, one of the world’s most widely used software package registries.