GitHub has restricted unvalidated npm trusted publishing configurations to expire 48 hours after creation. This update follows the discovery of a flaw that allowed attackers to push unauthorized updates to other users’ packages without requiring stolen credentials or account access.
READ THE ORIGINAL ARTICLE AT THEHACKERNEWS.COM →