GitHub’s internal repositories — now staged publishing in npm 11.15.0 requires a human 2FA approval before any package goes ...
A single npm user on Thursday published 14 malicious packages within a four-hour window, all mimicking popular OpenSearch, Elasticsearch, DevOps, and environment-configuration libraries, according to ...
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ...
A malicious version of Bitwarden's command-line interface was briefly published to npm after attackers compromised its GitHub Actions pipeline. The malware targeted developer and cloud credentials, ...
Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings ...
A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...
The malware authors behind the npm worm Shai-Hulud have released the source code. Now the first clones are appearing.
TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious versions anyway. The CI/CD Trust-Chain Audit Grid maps the six gaps it ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results