npm

Everything Vector Update has reported about npm: 2 stories, newest first. Part of our Vulnerabilities coverage.

Update GitHub repos now: npm Trusted Publishing flaw let attackers hijack 1,500+ packages via abandoned names

A vulnerability in npm's Trusted Publishing feature allowed unauthorized code pushes. GitHub has released fixes for the more than 1,500 affected packages.

Oct 19, 2026

Vulnerabilities

Update npm Trusted Publishing Configuration to Prevent Package Hijacking

GitHub has fixed a flaw in npm Trusted Publishing that allowed attackers to publish malicious code to over 1,500 packages by claiming old repository names.

Oct 13, 2026