This is the Daily Tech News for Tuesday, March 31st, 2026. We tell you what you need to know,

give you the important context and help each other understand.

Yeah, and today there's a lot to understand. We have a supply chain attack on a JavaScript

package that is affecting millions of apps. This is the kind of thing that you may think doesn't affect you right away, but if something goes weird, you might want to know that this could be why. And if you're a developer, you're definitely going to want to know about this. Absolutely, if you're a developer. We're going to get into what it actually is. I'm Jason Howell.

I'm Tom Merritt.

And we're going to start with what you need to know with a big story.

And big thank you to Motang, who noted this story in our subreddit.

So much activity happening in the subreddit.

Love it.

One of the most popular packages for developers to get their apps,

front end or back end, to communicate, suffered a supply chain attack.

This is what Tom was talking about at the top.

How did they do this?

Well, I'm going to hand it over to Tom because he's the one that did some deep,

deep learning on this because it is very developer focused.

Yes.

Jason prompted my deep learning package.

So, and security professionals, we are going to simplify some things here.

So do forgive it, but I think this is mostly going to give people the accurate permission

or accurate impression.

And you should go dig into it more

if you are affected. An attacker compromised the maintainer account of the lead maintainer of the

...