Security incident: A vulnerability in npm trusted publishing allowed attackers to hijack packages, prompting GitHub to implement new configuration expiry rules.

GitHub implemented new configuration expiry rules for npm trusted publishing to prevent package hijacking vulnerabilities.

{"feed_item_id":"219b3c5b-356a-4862-bc11-adb4211fcf91","feed_item_link":"https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html","analysis":{"mentioned_companies":["GitHub","Microsoft"],"is_security_incident":true,"incident_type":"vulnerability","severity":"high","summary":"A vulnerability in npm trusted publishing allowed attackers to hijack packages, prompting GitHub to implement new configuration expiry rules.","confidence":1,"cve_ids":[]}}