Attributed metadata history
Up to 100 retained publisher events per page for e208fd9178a6c9148fcd967b06388c7582314972bddcb44424fc58f7fd89cdbe. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_636032c91a0b4c9a97
observed · 2026-10-13 22:40:03 UTC
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary
Fingerprint: 67ca4da552724cd34d6aa8701890ddf857cd3561f793ed9b9fab8e5d3bdc58af
intelligence_src_636032c91a0b4c9a97
observed · 2026-10-12 10:37:03 UTC
available
Fingerprint: cc58046b4b1d7fb963844e45a69d2195cff987918478e05287925b56bc65734d