Shai-Hulud Broke npm's Trust Model. Here's the Replacement
A self-replicating worm hit 500+ packages by stealing publish tokens. npm's fix removes the tokens instead of trusting them harder.
6 min read
Security
Supply chain risk, dependency trust, and the vulnerabilities that actually reach production.
1 article