Malicious JavaScript

October 24, 2025

How Cloudflares client-side security made the npm supply chain attack a non-event

A recent npm supply chain attack compromised 18 popular packages. This post explains how Cloudflares graph-based machine learning model, which analyzes 3.5 billion scripts daily, was built to detect and block exactly this kind of threat automatically.

October 16, 2025

Improving the trustworthiness of Javascript on the Web

There's no way to audit a sites client-side code as it changes, making it hard to trust sites that use cryptography. We preview a specification we co-authored that adds auditability to the web.

September 25, 2025

Safe in the sandbox: security hardening for Cloudflare Workers

We are further hardening Cloudflare Workers with the latest software and hardware features. We use defense-in-depth, including V8 sandboxes and the CPU's memory protection keys to keep your data safe.

March 19, 2025

How we train AI to uncover malicious JavaScript intent and make web surfing safer

Learn more about how Cloudflare developed an AI model to uncover malicious JavaScript intent using a Graph Neural Network, from pre-processing data to inferencing at scale.