@securityonline.bsky.socialGitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.
#npm #TrustedPublishing #GitHub #GitHubActions #SupplyChainSecurity #OIDC #OpenSource #DevSecOps
@thedailytechfeed.comGitHub closes npm trusted-publishing loophole by binding trust to permanent IDs and enforcing 48-hour validation. #SupplyChain #npm #GitHub #Cybersecurity #TrustedPublishing #Security thedailytechfeed.com/github-fixes...
@thedailytechfeed.comnpm’s SlugFest lets attackers hijack package names via GitHub slugs. #npm #TrustedPublishing #SlugFest #SupplyChain #OIDC #DevSecOps https://thedailytechfeed.com/slugfest-npms-trusted-publishing-glitch-exposes-1500-packages/
@thedailytechfeed.comGHAPPIER Loader exploited trusted npm publishing via GitHub Actions; PolinRider linked attack spawns self-deleting loader and blockchain-based C2. #SupplyChain #Security #npm #TrustedPublishing https://thedailytechfeed.com/ghappier-loader-npm-supply-chain-breach-linked-to-polinrider/
@alekseialeinikov.comnpm-Lieferkettenangriffe abwehren: Was wirklich hilft
Das npm-Ökosystem hat sich 2026 stark verändert. Was jetzt standardmäßig sicher ist, was Sie diese Woche selbst einschalten sollten und welche Lücken weiterhin ganz bei Ihnen…
#npmlieferkettenangriff #supplychainsecurity #trustedpublishing
@alekseialeinikov.comnpm Supply Chain Attack Mitigation: What Actually Works
The npm ecosystem changed a lot during 2026. What is now secure by default, what is opt-in and worth turning on this week, and which gaps are still entirely yours to close.
#npmsupplychainattack #supplychainsecurity #trustedpublishing