GitHub imposes 48-hour expiry on npm trusted publishing to fix supply chain flaw

·1 views

GitHub has implemented a 48-hour expiration window for unvalidated npm trusted publishing configurations. This change addresses a vulnerability discovered by Bloom Security on June 6, 2026, which exploited how repositories were identified. The flaw allowed attackers to claim abandoned repository names and publish unauthorized package updates. Over 1,500 vulnerable packages had been downloaded more than 10 million times.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Ivanti VPN zero-days chained for root access, one flaw remains unpatched

On October 13, 2026, cybersecurity firm Volexity disclosed that an attacker chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances. The attack, attributed to a threat actor tracked as UTA0576, allowed unauthorized root-level command execution on a fully patched system as early as October 3. Ivanti has released patches for the authentication bypass and remote code execution flaws, tracked together as CVE-2026-104935. However, the third vulnerability in the chain, a privilege escalation flaw, remains unpatched as of the disclosure. The company advises customers on affected versions to upgrade immediately due to limited active exploitation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Computer Science student prepares for Hacktoberfest 2026 open source contributions

A Computer Science undergraduate at IIIT Lucknow is preparing to participate in Hacktoberfest 2026. The student aims to use the event to begin contributing to open-source projects for the first time. They plan to focus on understanding codebases, finding suitable issues, improving Git workflows, and connecting with developers. Their technical interests include C++, web development with React, blockchain, and AI applications. The student seeks repository recommendations and hopes to improve collaborative development skills through genuine contributions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developers test data grid performance by running Doom through it as a live display

A team used the classic game Doom as a live data stress test for a Lattice Grid component. They compiled the game to WebAssembly and used its video output as a stream of row updates for the grid. The grid, unaware it was rendering a game, processed these updates via its standard API. This extreme test led to performance improvements in conditional formatting and partial updates, which were subsequently released to all users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google's Gemini 4 Argon Enables Autonomous Code Auditing and Performance Gains

Google DeepMind's Gemini 4 Argon model introduces new capabilities for software engineering and security. It achieved a state-of-the-art score of 77.9% on the DeepSWE benchmark and provided a 40% speedup for a Python development kit. The model features a one-million-token capacity for both input and output, enabling deep analysis of large codebases. Its architecture supports stateful, multi-turn interactions to maintain reasoning across complex tasks. All related production code is available as open-source on GitHub.

0 comments Read more at DEV Community