Topic Thread
3 published observations tracking this thread.
The September 2026 package-registry funding pledge is bigger than pricing: it recognizes npm, PyPI, Maven Central, crates.io, and similar services as load-bearing infrastructure for modern software supply chains.
npm automation can now prepare a release without being able to publish it directly. That small permission change matters because it separates build automation from the final act of putting a package on the public registry.
The new fact is not that TanStack was compromised in May; it is that a credential stolen then was later used to copy CrowdSec's private repositories, showing why offboarding and token revocation remain part of supply-chain incident response.
