PyPI project pages now show provenance and security warnings
The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.
Stories per day · 30 days
2 RSS
Relatedgithub2npm2oidc2slugfest2supply-chain2attestations1bloom-security1package-hijacking1pypi1python1slsa1software-supply-chain1
5 stories, newest first · one card per story
Stories tagged #trusted-publishing
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires unused npm trusted-publisher configs after 48 hours following a slug-reuse flaw affecting 1,500-plus packages.
Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A now-fixed npm Trusted Publishing flaw exposed over 1,500 packages to repository-name hijacks.
4
Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor
CloudSEK details GHAPPIER campaign compromising 65 GitHub repos to backdoor the @dforge-core/dforge-mcp npm package with cryptographically verified provenance.
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
3