Security News GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking TheHackerNews Daniel Bender 13 Oct 2026 Share GitHub now expires unvalidated npm trusted publisher bindings after 48 hours to limit package hijacks through reclaimed repository names.
