NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#package-hijacking

0 stories this week · 1 this month · 2 in 6 months · mostly security

Stories per day · 30 days

Relatedgithub1 npm1 oidc1 slugfest1 supply-chain1 trusted-publishing1

2 stories, newest first · one card per story

The Hacker News29d agohigh

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub expires unused npm trusted-publisher configs after 48 hours following a slug-reuse flaw affecting 1,500-plus packages.

6 min readnpm github

8

SecurityWeekSep 22, 2026high

Malicious B-tree NPM Package Accumulates Millions of Downloads

Ongoing NPM supply chain campaign hides malware in indexed-btree's prototype code, reaching 2 million weekly downloads before detection.

Exploited2 min readnpm supply-chain

1