A flaw in npm’s Trusted Publishing mechanism could let attackers publish malicious updates to legitimate packages without compromising a developer’s npm account, GitHub account, or publishing token. Researchers identified more than 1,500 potentially exposed packages with over 10 million combined downloads. The weakness is particularly concerning as AI coding agents increasingly select, install, and execute […] The post Attackers Can Hijack npm Packages Without Stealing Developer Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
First seen on gbhackers.com
Jump to article: gbhackers.com/npm-packages-hijacked/
