npm

npm’s worm problem outran the registry’s own security fix

Months after npm revoked long-lived publishing tokens, the May 2026 Mini Shai-Hulud wave hit 169 packages by abusing the OIDC…