Loading story…
Microsoft said NuGet.org will shorten the lifetime of newly created API keys from 365 days to 30 days to reduce software supply-chain risk from stolen publishing credentials. The change takes effect on August 17, 2026, and Microsoft warned that attackers who obtain long-lived keys can publish trojanized .NET packages under trusted project names, creating rapid downstream exposure for developers and enterprises.
The company also said all NuGet API keys created before that date will expire on November 1, 2026, requiring maintainers to generate new keys or migrate to NuGet Trusted Publishing. Microsoft is pushing the OIDC-based model, introduced in 2025, because it replaces reusable secrets with short-lived session credentials for workflows such as GitHub Actions and GitLab, and cited the NX Console npm package compromise as a recent example of how stolen publishing credentials can be used to poison software packages.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
NuGet.org announced that all API keys created before August 17, 2026 will expire on November 1, 2026 as part of its supply-chain security changes. The move extends the API key lifetime reduction beyond newly created keys to force rotation of older long-lived publishing credentials.
Microsoft introduced NuGet Trusted Publishing in September 2025 as a keyless publishing option for NuGet.org. The feature uses OpenID Connect to authenticate publishing workflows and issue temporary session-based credentials instead of long-lived API keys.
Microsoft announced that new NuGet.org API keys will be limited to 30 days instead of 365 days to reduce supply-chain risk from stolen publishing credentials. The company also urged maintainers to adopt Trusted Publishing as a more secure alternative to reusable secrets.
Microsoft cited a recent NX Console npm package compromise in which an attacker used stolen publishing credentials to release a malicious package. According to the NX Dev Team, the malicious package was activated 6,000 times in 36 minutes before it was removed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcedevblogs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub has changed Dependabot to wait three days before opening pull requests for non-security version updates, aiming to keep fast-moving malicious package releases out of automated developer workflows. The company said the change was driven by repeated software supply-chain incidents in which poisoned npm releases were detected and removed within hours, but still had enough time to be pulled into builds. GitHub pointed to a 2025 npm compromise in which an attacker phished a maintainer and published malicious versions of widely used packages including **`chalk`** and **`debug`**, with code that rewrote cryptocurrency wallet addresses before the packages were taken down roughly two hours later. Security updates tied to known advisories are not delayed and will still be issued immediately. The move aligns with broader industry guidance that the first hours after a package is published are the highest-risk period for dependency consumers. Research cited similar attacks affecting 18 npm packages with more than 2.6 billion weekly downloads and the **Nx** build attack, which remained live for about four hours, reinforcing recommendations to delay automated updates by 24 to 48 hours or longer. GitHub said the npm ecosystem logged more than 6,500 malware advisories in the year ending May 2026 and urged teams to combine cooldowns with other controls, including lockfiles, careful review before merge, scoped CI tokens, disabling install scripts where possible, and pinning dependency versions to reduce supply-chain exposure.
Jul 29, 2026
A series of high-profile supply chain attacks targeted the npm ecosystem, compromising hundreds of packages and exposing sensitive data. The s1ngularity attack exploited a vulnerability in GitHub Actions to steal npm publishing tokens for Nx packages, leading to the distribution of credential-harvesting malware and the public exposure of thousands of private repositories and secrets. Another incident involved a phishing campaign against a prominent npm maintainer, resulting in the compromise of widely used packages such as debug and chalk. These attacks highlighted the persistent risks posed by weak CI/CD protections, compromised dependencies, and social engineering tactics. In response to these incidents, GitHub implemented stricter security measures for npm package publishing. The new requirements include mandatory two-factor authentication (2FA) for all local publishing, limiting token lifetimes, and promoting trusted publishing workflows. Legacy authentication methods are being deprecated in favor of FIDO-based 2FA, and developers must now use hardware security keys, biometrics, or authenticator apps for authentication. These changes aim to reduce the risk of account takeovers and malware injection, but experts warn that additional security practices are necessary to address other attack surfaces within the software supply chain.
Jun 29, 2026
GitHub has released **npm v12** with major supply-chain protections enabled by default, blocking lifecycle install scripts, implicit `node-gyp` rebuilds, Git dependencies, and remote URL dependencies unless users explicitly approve them. The change is aimed at reducing install-time code execution abused by recent npm malware campaigns, and introduces an allowlist-style workflow for trusted scripts. GitHub also began phasing out granular access tokens that bypass two-factor authentication: those tokens will lose sensitive account, package, and organization management capabilities starting in August 2026, and are set to lose direct publishing rights in a later phase, with maintainers encouraged to use trusted publishing via **OIDC** or staged publishing with human 2FA approval instead. **pnpm 11.10** shipped parallel hardening measures focused on preventing credential theft and unsafe build behavior in package workflows. The release adds a structured `_auth` setting that binds credentials to a specific registry URL and only reads them from global configuration or environment variables, blocking malicious project files such as `.npmrc` or `pnpm-workspace.yaml` from redirecting tokens to attacker-controlled hosts. It also stops forwarding upstream registry credentials to install-accelerator servers, restricts `pnpm deploy` and `pnpm pack-app` from writing outside the project, prevents repositories from substituting macOS code-signing tools, and fixes a prototype pollution issue involving a dependency named `__proto__`.
Jul 14, 2026