npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

A wave of high-impact supply chain and exploitation incidents: npm introduced staged publishing with 2FA to mitigate pre-release supply-chain abuse; multiple package registries were targeted (Packagist, Composer, Laravel-Lang) to deliver Linux malware and credential stealers; an automated campaign (Megalodon) injected malicious GitHub Actions into thousands of repos; GitHub internal repositories were exfiltrated after a poisoned Nx Console VS Code extension; Microsoft disrupted a malware‑signing-as-a-service operation. Several high-severity, actively exploited vulnerabilities were disclosed/ke