npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

A cluster of high-impact supply-chain and exploited vulnerabilities dominated recent reporting: npm added staged publishing with 2FA to curb malicious releases as Packagist and multiple PHP (Laravel‑Lang) packages were backdoored to deliver Linux malware and credential stealers. Large automated attacks and repository compromises were observed — Megalodon injected malicious CI workflows into over 5,500 GitHub repos, and a poisoned Nx Console VS Code extension led to exfiltration of 3,800+ internal GitHub repositories. Multiple high-severity/actively exploited CVEs were disclosed or added to CIS