9 Pitfalls of npm publish to Avoid Before Release: A Checklist for MCP Plugin Developers

Introduction — "Working" and "Distributable" Are Different ThingsWith Claude Desktop, Claude Code, Cursor, and others ...
The Hacker News

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub now expires unvalidated npm trusted publisher bindings after 48 hours to limit package hijacks through reclaimed ...
CSO Online

Over 1,500 npm packages exposed by Trusted Publishing validation flaw

A weakness in npm's trust model could let attackers publish updates to legitimate packages by claiming abandoned GitHub ...

“Just changing the repository name” is fatal. Breaking down the design flaw in Trusted Publishing

Reading this news, I groaned, 'The security mechanism itself has a hole in it.'Security firm Bloom Security discovered a flaw ...
HackerNoon

Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to Malicious Takeover

Bloom Security uncovered a flaw in npm Trusted Publishing that exposed 1,500+ packages to potential malicious takeovers via ...
CSOonline

Compromised npm package silently installs OpenClaw on developer machines

A new security bypass has users installing AI agent OpenClaw — whether they intended to or not. Researchers have discovered that a compromised npm publish token pushed an update for the widely-used ...
Help Net Security

npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover

An npm Trusted Publishing flaw let anyone claiming an abandoned GitHub repo name publish to 1,500+ packages. GitHub says it ...