Loading story…
Package ecosystem maintainers and security vendors highlighted new guardrails and failure modes in automated dependency workflows. npm CLI 11.x introduced minimumReleaseAge, a release “cooldown” control that blocks installation of newly published versions until they reach a configured age, aiming to reduce exposure to malicious packages that rely on rapid adoption before detection or takedown. npm also added bulk configuration for OIDC trusted publishing, aligning with broader efforts to harden CI-based publishing; similar release-age gating has already been implemented in other Node.js package managers (pnpm, Yarn, and Bun), though npm’s initial implementation lacks an exclusion mechanism for cases like urgent internal hotfixes.
Separately, StepSecurity reported detecting a “release storm” affecting multiple Microsoft @types/* packages on npm, where dozens of semver releases were published within 24 hours with no code changes beyond repeated deprecation-version bumps—attributed to an automation loop tied to a scheduled GitHub Actions workflow in microsoft/DefinitelyTyped-tools (publish-packages.yml). In the Go ecosystem, a maintainer of widely used cryptography code criticized GitHub Dependabot for generating large volumes of low-signal alerts and PRs after a minor security fix, arguing the tool often flags repositories based on dependency presence rather than reachability/actual impact, creating alert fatigue and potentially reducing security; he recommended reachability-aware tooling such as govulncheck for Go vulnerability triage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Recent npm CLI 11.x releases, including 11.10.0, introduced new supply-chain security features such as minimumReleaseAge to delay installs of newly published versions, an --allow-git flag to restrict Git dependency behavior, and general availability of bulk OIDC trusted publishing via npm trust. These changes aim to reduce risk from malicious releases, unexpected code execution paths, and long-lived publishing tokens.
Valsorda publicly argued that Dependabot's false positives, misleading compatibility warnings, and questionable CVSS v4 scoring create alert fatigue and can reduce real security. He recommended reachability-aware tools such as govulncheck for Go and said vulnerability management requires impact assessment beyond automated dependency updates.
After the filippo.io/edwards25519 security fix, GitHub Dependabot opened thousands of pull requests against repositories that were not actually affected. Valsorda said the tool appeared to flag projects based on dependency presence rather than reachable vulnerable code paths.
Go cryptography maintainer Filippo Valsorda released a security fix in his EdDSA-related Go library filippo.io/edwards25519. The fix later triggered widespread automated alerts and pull requests from GitHub Dependabot.
Maintainer jakebailey quickly identified the root cause and merged a one-line fix in PR #1255 on the same day the issue was reported. The change stopped the repeated publication of deprecated @types package stubs.
StepSecurity disclosed the issue to maintainers by opening GitHub issue #1254. The report documented that an automation bug in a trusted supply-chain pipeline was causing repeated package releases.
Investigation found a loop guard failure in the microsoft/DefinitelyTyped-tools publish-packages.yml workflow, where an undefined label was passed instead of "latest". As a result, the deprecation check failed and the workflow re-published affected deprecated stubs every 30 minutes, producing more than 70 identical releases.
On February 17, 2026, StepSecurity's AI Package Analyst identified a burst of semver-only releases across multiple deprecated npm @types packages with no code changes between versions. The activity was traced to repeated automated publishes rather than a malicious package compromise.
During 2025, pnpm, Yarn, and Bun added time-based install delay controls to reduce exposure to newly published malicious package versions. This established a broader ecosystem trend toward package-manager-enforced supply-chain protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
socket.dev
Open sourcestepsecurity.io
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026
Security researchers reported an npm supply-chain compromise involving a malicious package, `polymarket-clob`, that targeted cryptocurrency users by exfiltrating sensitive local files (including `.env`, `wallets.json`, and `keys/*.json`) to attacker-controlled infrastructure. The package was published in the npm registry, downloaded at least 189 times (lower bound), and later removed and replaced with a security placeholder; analysis of the code and infrastructure pivoting linked the campaign to broader activity consistent with wallet-drainer operations and **Vidar** stealer-related infrastructure, including reuse of SSH fingerprints and consistent hosting patterns. Separately, researchers disclosed **six JavaScript “zero-day” bypass issues** across multiple package managers—**npm, pnpm, vlt, and Bun**—that undermine common defensive controls used to reduce supply-chain risk, including disabling lifecycle scripts and relying on lockfile integrity. The issues (dubbed **“PackageGate”**) reportedly enable paths to regain install-time code execution or weaken integrity guarantees via mechanisms such as Git dependency handling, tar extraction behaviors, and incomplete integrity coverage for URL-based tarballs; pnpm, vlt, and Bun were reported as patched, while npm characterized the behavior as “works as expected,” raising concern that package-manager-level weaknesses could enable large-scale compromise even in hardened environments.
Jun 29, 2026
Security researchers reported two distinct software supply-chain abuse paths that can make malicious code appear to originate from trusted sources. GMO Cybersecurity by Ierae described an active campaign dubbed **“repo squatting”** that abuses how GitHub renders and links commits from forks: a commit made in an attacker-controlled fork can be viewed under the upstream project’s URL structure, enabling convincing links like `github.com/<official-org>/<repo>/commit/<hash>` that appear to belong to the official repository. The campaign targeted the *GitHub Desktop* project by distributing a trojanized installer carrying **HijackLoader**, with the malicious download link presented in a way that could mislead users and some security tooling into believing it came from the official repo. Separately, Koi researchers disclosed **PackageGate** weaknesses in JavaScript dependency tooling that allow bypassing npm’s post–**Shai-Hulud** mitigations when installing **Git-based dependencies**. They reported that a malicious `.npmrc` in a Git dependency can override the `git` binary path, enabling **code execution even when lifecycle scripts are disabled** (e.g., `--ignore-scripts=true`), affecting multiple tools (including *pnpm*, *vlt*, *Bun*, and *npm*). Vendors reportedly addressed the issue in the non-npm tools, while npm closed the report as “works as expected,” and researchers cited evidence of prior proof-of-concept abuse (e.g., reverse shell) indicating practical exploitation risk for organizations relying on Git dependencies in CI/CD and developer environments.
Jun 29, 2026