Security Unlocked

Npm

Threat Intelligence

The Namespace Was the Credential

Three independent threat actors operating simultaneously on npm this week confirm that adversaries have collectively assessed its namespace trust model as a high-yield, structurally undefended attack surface.

6 min read
Threat Intelligence

The Registry Trusted the Token

GitHub OIDC trusted-publishing solved the stored-credential problem and created a new attack surface in the same motion: three independent actors exploited it in a single week, producing malicious packages carrying valid provenance attestations.

6 min read