Une faille npm Trusted Publishing a exposé plus de 1 500 paquets npm à une prise de contrôle

Résumé de la source, en anglais

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes va...