Topic Thread
5 published observations tracking this thread.
npm automation can now prepare a release without being able to publish it directly. That small permission change matters because it separates build automation from the final act of putting a package on the public registry.
GitLab patched CVE-2026-85706 on September 10 and CISA added it to the Known Exploited Vulnerabilities catalog on September 11. The newer operational signal is GitLab's guidance for checking whether suspicious requests actually disclosed file contents.
GitHub is moving a risky GitHub Actions trigger from an easy-to-misconfigure workflow choice toward an explicit policy decision. The change is important for open-source maintainers, especially repositories that process fork pull requests.
The new fact is not that TanStack was compromised in May; it is that a credential stolen then was later used to copy CrowdSec's private repositories, showing why offboarding and token revocation remain part of supply-chain incident response.
Brevo's September 14 incident is a useful case study in a web supply-chain boundary that file-integrity checks can miss: attackers changed responses at the CDN edge while origin files stayed untouched.
