Tag: npm | Adswds

Oct 14, 2026 · adswds team · Security

npm trusted publishing’s 48-hour rule: what CI must change after slug reuse

Landian News: GitHub requires first successful publish within 48 hours for new npm Trusted Publishing configs, closing a repo-name reuse (SlugFest) window; issue_comment tokens are rejected. Tighten ad/landing release pipelines accordingly.

Oct 2, 2026 · adswds team · Security

TeamPCP follow-up: Google’s undercover analyst—and what victims should rotate first

Landian News relays Google Threat Intelligence: a Mandiant analyst joined TeamPCP’s CanisterWorm core chat, helping revoke stolen credentials and tip law enforcement. For ad-tech stacks on npm, the lesson is credential lifespan—not the thriller plot.

Sep 5, 2026 · adswds team · Security

After TeamPCP arrests: npm worms don’t stop—keep the checklist

Landian News: AFP/FBI arrest two TeamPCP cores behind mini Shai-Hulud. Open-sourced worms may continue. Keep pins, short tokens, postinstall audits.