npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
2026-05-24T19:24:12Z•edb65119d9d0dc7387593f2ee460e305d8143ca61a38b6a37de0af527b34dd93
CISA-KEVactive-exploitationcomposercredential-theftgithublaravel-langlinux-kernelmalwarenpmpackagistsupply-chainvulnerability
What happened
A broad wave of high-impact security incidents and supply-chain attacks was reported: multiple package ecosystem compromises (npm staged publishing controls announced; Packagist and Laravel‑Lang PHP packages seeded with malware/credential stealers; Megalodon campaign injected malicious GitHub Actions into thousands of repos), high‑severity product vulnerabilities being actively exploited or added to CISA KEV (LiteSpeed cPanel CVE-2026-48172, Drupal CVE-2026-9082, Cisco CVE-2026-20223, Microsoft Defender CVE-2026-41091), discovery of a 9‑year‑old Linux kernel flaw (CVE-2026-46333), and large‑规模
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- edb65119d9d0dc7387593f2ee460e305d8143ca61a38b6a37de0af527b34dd93
- Enrichment time
- 2026-05-24T19:24:12Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.