npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
2026-05-24T01:24:05Z•9e1bfacf913f3545589aa0e6c724da13f525033d180741989c35630ba5c497ff
active-exploitationai-securityanthropicci-cdcisaciscocredential-stealerdrupalgithub-breachkevlaravel-langlaw-enforcementlinux-kernelliteSpeedmalicious-vscode-extensionmalicious-workflowsmalwaremegalodonmicrosoft-defendernpmpackagistrampartsupply-chaintakendownvpn
What happened
A broad wave of high-impact security events and active exploitations was reported across software supply chains, open-source ecosystems, enterprise products, and cloud/CI infrastructure. Notable supply-chain incidents include npm's new 2FA-gated staged publishing, a Packagist campaign delivering a GitHub-hosted Linux binary to eight packages, and multiple compromised PHP packages in the laravel-lang ecosystem delivering a credential stealer. Large-scale repository and CI abuse was observed in the Megalodon campaign (5,561 GitHub repos) and a GitHub internal breach tied to a poisoned Nx Console
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 9e1bfacf913f3545589aa0e6c724da13f525033d180741989c35630ba5c497ff
- Enrichment time
- 2026-05-24T01:24:05Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.