⚡ GitHub tightens npm security after 1,500+ packages were found vulnerable to hijacking without stolen credentials.

Attackers could claim a freed GitHub repo name tied to a trusted-publisher binding that had never published.

Unvalidated bindings now expire after 48 hours.

Learn more: https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html