npm’s worm problem outran the registry’s own security fix
Months after npm revoked long-lived publishing tokens, the May 2026 Mini Shai-Hulud wave hit 169 packages by abusing the OIDC…
Months after npm revoked long-lived publishing tokens, the May 2026 Mini Shai-Hulud wave hit 169 packages by abusing the OIDC…