{
  "id": 14281163,
  "title": "New stricter rules from GitHub for code packages after security investigation",
  "url": "https://urgent.news/2026/10/13/new-stricter-rules-from-github-for-code-packages-after-security",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T20:01:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hacksgr/new-stricter-rules-from-github-for-code-packages-after-security-investigation-1j5"
  },
  "original_language": "en",
  "account": null,
  "summary": "GitHub has introduced stricter rules for code packages following a security investigation, implementing a 48-hour expiration window for unvalidated npm trusted publishing configurations. This update aims to close a supply chain loophole that allowed attackers to exploit abandoned repository slugs and publish package updates without proper credentials. The vulnerability was identified by security firm Bloom Security, who discovered that GitHub's system relied on the name of the address rather than a permanent digital identifier, making it possible for skilled attackers to claim abandoned repository slugs and publish malicious changes to software they did not own. As a result, GitHub has decided that trust settings that have not been validated with a successful publish will automatically expire within 48 hours of their creation. To address this issue, software creators are advised to check the settings of trusted connections, delete and recreate links if repositories are renamed or moved, and monitor for any unexpected posts.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "SecurityWeek",
        "title": "Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach",
        "url": "https://urgent.news/2026/10/13/meta-says-hackers-took-code-personal-data-of-1-500-in-github-breach",
        "published": "2026-10-13T16:01:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}