SECURITYJun 10 · 19:41 UTCBLEEPING COMPUTERBill Toulas

GitHub announces npm security changes to tackle supply-chain attacks

GitHub has announced npm v12 will introduce security-focused changes to block supply-chain attacks exploiting the 'npm install' command. The updates aim to prevent malicious behaviors triggered by this command.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

GitHuborganizationnpmtopicsupply-chain attackstopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYMay 14 · 20:26 UTC
OpenAI asks macOS users to update after TanStack npm supply chain attack
SECURITYJun 1 · 17:40 UTC
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
SECURITYApr 22 · 12:57 UTC
New npm supply-chain attack self-spreads to steal auth tokens
SECURITYJun 5 · 18:05 UTC
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
SECURITYApr 30 · 23:21 UTC
The never-ending supply chain attacks worm into SAP npm packages, other dev tools
SECURITYApr 29 · 22:43 UTC
Official SAP npm packages compromised to steal credentials