Npm completes authentication overhaul to harden package publishing
Security Tool/Service
Summary
Hide ▲
Show ▼
npm completed a major authentication overhaul in December 2025 after the Sha1-Hulud incident, replacing classic tokens with short-lived session tokens and MFA for publishing. The move is meant to reduce supply-chain attacks across the npm / Node.js ecosystem. Residual risk remains because MFA phishing and optional 90-day tokens with MFA bypass can still enable malicious package publication.
Related Happenings
AsyncAPI repositories and npm publishing workflow hit by network compromise
Incident
H score27
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
AsyncAPI repositories and npm publishing workflow hit by network compromise
IncidentAbout this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
GitHub npm version 12 hardens installs and token management
Security Tool/Service
H score11
First: 09.07.2026 19:49
Last: 09.07.2026 19:49
Sources 1
About this happening:
GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...
GitHub npm version 12 hardens installs and token management
Security Tool/ServiceAbout this happening: GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...
GitHub npm GAT publish-token mitigation guidance
Advisory/Mitigation
H score25
First: 09.07.2026 19:49
Last: 09.07.2026 19:49
Sources 1
About this happening:
GitHub is steering npm users away from long-lived publish tokens as npm GATs that bypass 2FA lose direct publishing and sensitive-management abilities. The recomme...
GitHub npm GAT publish-token mitigation guidance
Advisory/MitigationAbout this happening: GitHub is steering npm users away from long-lived publish tokens as npm GATs that bypass 2FA lose direct publishing and sensitive-management abilities. The recomme...
Npm v12 default-blocks install scripts, Git dependencies, and remote URLs
Security Tool/Service
H score11
First: 12.06.2026 16:00
Last: 12.06.2026 16:00
Sources 1
About this happening:
GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...
Npm v12 default-blocks install scripts, Git dependencies, and remote URLs
Security Tool/ServiceAbout this happening: GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...
Red Hat npm Namespace Hijacked in Supply Chain hit by cyberattack
Incident
H score13
First: 01.06.2026 20:40
Last: 01.06.2026 20:40
Sources 1
About this happening:
Red Hat's official npm namespace was hijacked in a supply chain attack that republished 32 packages in the @redhat-cloud-services scope on June 1, 2026. The ma...
Red Hat npm Namespace Hijacked in Supply Chain hit by cyberattack
IncidentAbout this happening: Red Hat's official npm namespace was hijacked in a supply chain attack that republished 32 packages in the @redhat-cloud-services scope on June 1, 2026. The ma...
Timeline
-
13.02.2026 12:45 2 articles · 5mo ago
Initial report: Npm completes authentication overhaul to harden package publishing
Initial Disclosurenpm began hardening package publishing in December 2025 by retiring classic tokens and shifting toward session-based authentication. The initial phase centered on reducing the blast radius of stolen credentials after the Sha1-Hulud incident.
Show sources
- npm’s Update to Harden Their Supply Chain, and Points to Consider — thehackernews.com — 13.02.2026 12:45
- npm’s Update to Harden Their Supply Chain, and Points to Consider — thehackernews.com — 13.02.2026 12:45