npm extends recovery-code security holds to all accountsBy RepublisherSeptember 11, 2026 npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that…
Multiple trusted publishing configurations for npmBy RepublisherSeptember 3, 2026 We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are…
How we took malware advisories beyond npmBy RepublisherAugust 7, 2026 A compromised package can steal credentials the moment you install it, and until recently, GitHub could only flag those in…
Restricting npm bypass-2FA granular access tokensBy RepublisherAugust 1, 2026 npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions.…
