GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary
What happened
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary
Why it matters
The development may change operating conditions or market expectations around Microsoft. Further confirmation and measurable outcomes matter.
Affected entities
View evidence
1 reports · 1 original report · 1 independent
- The Hacker NewsPrimary source · Supports · EN · 100%GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking ↗
Claims
- GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking Observed
Conflicts
No material conflict detected in the available evidence.
Timeline
- First reported
Market move following event
Market reaction is not yet available for this asset and time window.