> TritonInfoSec News
Home / Oct 14, 2026 / Story
0
#9 The Hacker News general October 13, 2026 at 16:18 UTC

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

By [email protected] (The Hacker News)

AI Summary

GitHub discovered that a flaw in npm's trusted publishing feature allowed attackers to push new versions of packages they didn't own without stealing credentials, leaving over 1,500 packages vulnerable to hijacking. GitHub's remediation was to auto-expire unvalidated trusted publishing configurations 48 hours after creation, with configurations becoming permanent only after a successful publish. This supply-chain risk is particularly significant given npm's role in JavaScript dependency ecosystems worldwide.

Read full article → https://thehackernews.com/2026/10/github-tightens-…

Relevance score: 81.0/100

# More from October 14

  1. 1
    Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug The Hacker News
  2. 2
    Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far The Hacker News
  3. 3
    Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers The Hacker News
  4. 4
    $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant SecurityWeek
  5. 5
    GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code The Hacker News
  6. 6
    DOJ charges 14 over a sprawling North Korean remote work scheme CyberScoop
  7. 7
    Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies The Hacker News
  8. 8
    SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft The Hacker News
  9. 10
    OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room The Hacker News