TOPICS / 1 STORY

npm Trusted Publishing

Every Pandromeda story on npm Trusted Publishing: news, explainers, comparisons and guides, newest first.

A name-vs-ID gap in npm Trusted Publishing let attackers hijack abandoned GitHub repo names to publish real packages. GitHub has since patched it.