npm publishing gap exposed more than 1,500 packages to takeover
Daily Cyber News: npm publishing gap exposed more than 1,500 packages to takeover
More than one thousand five hundred N P M packages were exposed to takeover through a weakness in Trusted Publishing. An attacker didn’t need to steal a password or another credential. Instead, registering a GitHub repository name that a maintainer had abandoned could allow the attacker to publish a new version of someone else’s package.
Key context: A package takeover can push malicious code downstream to developers and applications that trust normal software update channels.
Additional detail: The larger lesson is that identity continuity matters across connected development services.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.
Topics: cybersecurity news, cybersecurity, cyber risk, publishing, exposed, packages, takeover.
