npm adds 2FA-gated publishing to blunt supply-chain attacks

📰 LESSER-KNOWN / UNDER-REPORTED

• npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks — The Hacker News GitHub has launched “staged publishing” for npm packages, requiring maintainers to pass a two-factor authentication (2FA) challenge before approving releases publicly. This human-in-the-loop control aims to mitigate supply chain risks by preventing automated or unauthorized package publishing, significantly raising the bar for attackers targeting npm ecosystems.
• Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware — The Hacker News A coordinated supply chain compromise has infected eight Packagist Composer packages with malicious code that executes a Linux binary hosted on GitHub Releases. Notably, the malware was injected into package.json (targeting JavaScript projects) rather than composer.json, evading some standard detection tools. This hybrid targeting highlights evolving attacker tactics in cross-ecosystem supply chain attacks. Practitioners should audit dependencies and monitor for anomalous package.json modifications.