supply-chain
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
Medium
Summary
GitHub has addressed a significant vulnerability in its npm trusted publishing system, allowing attackers to hijack thousands of packages by claiming abandoned repository slugs. Over 1,500 vulnerable packages, downloaded over 10 million times, were identified. Developers are advised to audit their trusted publisher bindings and proactively delete them when repositories are renamed or transferred.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data