package-registries

GitHub says unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm now rejects trusted publishing tokens from GitHub Actions issue_comment events.

OX Security found 24 npm packages built solely to let mirrors like unpkg serve fake Cloudflare CAPTCHA pages that can redirect to ClickFix-style phishing.

GitHub now feeds Dependabot malware alerts from OpenSSF's malicious-packages data across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

A new Linux Foundation working group--backed by Sonatype, the Rust Foundation, OpenSSF, and a dozen registry operators--aims to close the funding and governance gap before AI-driven download volumes overwhelm critical open source infrastructure.

An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.