[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWpttzdnWGHvchulbw7XnCJ4cvBVFS-h7XlT3WXuoHbg":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"15551880-717c-4532-ae12-9510cb7173ff","GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking","github-tightens-npm-publishing-after-flaw-left-1-500-packages-vulnerable-to-hija-3d29c8","GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. \"Your configuration becomes validated and exempt from expiry after its first successful publish,\" the Microsoft-owned subsidiary","GitHub has implemented a 48-hour expiration for unvalidated npm trusted publishing configurations. This change follows the discovery of a vulnerability that allowed attackers to publish new versions of packages without needing to steal legitimate user credentials. The configuration becomes permanent after its first successful publish.","GitHub expires npm trusted publishing configs after 48 hours to prevent package hijacking.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fgithub-tightens-npm-publishing-after.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh3aDWaWT6PmRDL9d6tHPDisxclb_Ak7YZIxuS02EUFvNaWrc4_UKwUqW0RI1KT3r8zsneOguD6b85yg8mf3gAzZZOGuLi-mXckG_yzwmXXb3IchTBSVeRvPlUo7QU4Kp4yiM6QqPshmo4p0GQ55XZPTEDc0DZn9N84S_ZibZ4rkXuhZ3OvoHNCYH-wk0k-\u002Fs1600\u002Fgit-npm.jpg","2026-10-13T16:18:18+00:00","2026-10-13T18:00:14.244361+00:00",7,[17,20,23,25],{"name":18,"type":19},"npm","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":22},"Microsoft",{"name":26,"type":27},"open-source","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":28,"icon":30,"name":31,"slug":32},null,"Supply Chain","supply-chain",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":26},"ade75414-7914-4e23-a450-48b64546ee70","Open Source",[],[24,21,18],{"controls":48,"vendors":133},[49,78,106],{"slug":50,"name":51,"problem":52,"products":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":79,"name":80,"problem":81,"products":82},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":100,"vendor_name":21,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":107,"name":108,"problem":109,"products":110},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[111,119,125],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[134],{"slug":100,"name":21,"logo_path":101,"roles":135},[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":152},"npm-trusted-publishing-flaw-exposed-1500-packages-to-hijacking","npm Trusted Publishing Flaw Exposed 1,500+ Packages to Hijacking","A vulnerability in npm's trusted publishing feature allowed attackers to exploit unvalidated publishing configurations, enabling unauthorized package versions to be published without stealing credentials. The flaw highlights how misconfigured or unvalidated CI\u002FCD pipeline integrations can become an attack vector in the software supply chain. Because npm packages are consumed by millions of developers globally, even a single hijacked package can cascade into widespread downstream compromise. GitHub's 48-hour expiration window for unvalidated configurations is a meaningful mitigation, but organizations must also audit their own dependency chains for affected packages.",[142,143,144,145,146,147,148,149,150,151],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) PS.2: Protect All Forms of Code from Unauthorized Access","NIST SP 800-161: Supply Chain Risk Management","NIST CM-2: Baseline Configuration","NIST CM-6: Configuration Settings","NIST SI-7: Software, Firmware, and Information Integrity","SLSA Supply Chain Levels for Software Artifacts (Provenance Requirements)","OWASP Top 10: A06 Vulnerable and Outdated Components",{}]