Tag: trusted publishing
3 articles
GitHub Bolsters npm Security After Loophole Exposes 1,500 Packages to Hijacking
GitHub has stepped up npm security measures after a loophole was discovered, exposing over 1,500 packages to hijacking - with a whopping 10 million downloads between them. To prevent future breaches, GitHub now requires a 48-hour validation window for trusted publishing.
Attackers Exploit npm Trusted Publishing in GHAPPIER Supply Chain Campaign
Malicious actors have cleverly exploited npm's trusted publishing feature to unleash a supply-chain attack, using a hijacked maintainer account to distribute a sneaky loader called GHAPPIER. They got away with it by hiding behind a valid provenance attestation, highlighting a loophole in the system.
GitHub npm Tightens Security With Disabled Install Scripts
GitHub's latest npm update takes a giant leap in security by disabling install scripts by default, reducing supply-chain risks and giving developers more control. To adapt, plan to switch to trusted publishing or staged publishing with human approval for automated publishing.