npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
2026-05-24T07:24:04Z•c4c7e53be1299a4f22bb8005501317b33799173f5936e12ff08ab3c6be8ee86f
2FACI/CD-malicious-workflowsCISA-KEVCiscoDrupalGitHub-breachLinux-kernelLiteSpeedMegalodonMicrosoft-DefenderShowboatVSCode-extension-compromiseWebwormactive-exploitationcredential-stealerlaravel-langmalware-signingnpmpackagistransomware-servicesstaged-publishingsupply-chain
What happened
A wave of high-impact security incidents and supply-chain attacks dominated the news: npm introduced staged publishing with 2FA to curb malicious releases while multiple package ecosystems (Packagist, Laravel-Lang/Composer/JS packages) were hit with coordinated supply-chain malware and credential stealers. Major product vulnerabilities are being actively exploited or added to KEV, including maximum-severity flaws in LiteSpeed cPanel (CVE-2026-48172) and Cisco Secure Workload (CVE-2026-20223), a critical Drupal SQL injection now in CISA KEV (CVE-2026-9082), and active Microsoft Defender issues.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- c4c7e53be1299a4f22bb8005501317b33799173f5936e12ff08ab3c6be8ee86f
- Enrichment time
- 2026-05-24T07:24:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.