Tag

Supply Chain

1 post

October 2026

02 Oct 2026 The Token That Published the Worm: Trusted Publishing, Sigstore, and Provenance After Shai-Hulud Shai-Hulud did not exploit npm. It read publish tokens out of developers' .npmrc files and environment variables, used them to push poisoned versions of the victims' … Research 27 min read