New NPM Timing Attack Could Spur Supply Chain Threats Involving Malicious Packages

Keeping private packages private is crucial for organizations using them. Otherwise, attackers can create clones or typosquatted packages that hackers could trick employees of organizations into downloading and using in software projects.