Market & Regulation
npm Enhances Security for High-Impact Accounts
GitHub Changeloghigh confidence
Why it matters
- →Enhances security for widely used npm packages, reducing risk of malicious updates.
- →Proactively addresses a known attack vector in software supply chains.
- →Balances security with usability by maintaining package availability during safeguards.
npm has implemented a new security feature to protect high-impact accounts from potential takeover attacks. When changes like email updates or 2FA recovery code usage are detected, these accounts are temporarily placed in a 72-hour read-only mode. This measure prevents unauthorized actions such as publishing malicious packages. Users can still access and download packages during this period, ensuring continued availability. The account automatically returns to normal after the safeguard period, enhancing security without requiring user intervention.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
What happened next
- 1npm v12 Enhances Security with New Defaults
GitHub Changelog · July 8, 2026 · Related
- 2npm Tightens Security on Granular Access Tokens
GitHub Changelog · July 31, 2026 · Related
More from GitHub Changelog
© GitHub ChangelogCoding Toolscoding
GitHub Secret Scanning adds Lovable and Supabase detectors
GitHub quietly expanded its secret scanning partnership program to include Lovable Labs, Pydantic Services, and Supabase. This update means credentials from these popular development platforms are now automatically detected in public repositories, allowing the providers to revoke or rotate compromised keys before abuse occurs. For developers using Supabase or Lovable, this adds a critical layer of automated security hygiene without requiring manual configuration. It reflects GitHub's ongoing effort to integrate directly with the modern AI and database tooling stack that dominates current development workflows.
GitHub Changelog
© GitHub ChangelogCoding Toolscoding
GitHub Copilot Code Review API and Default Effort Change
GitHub finally exposes Copilot code review to external automation via REST and GraphQL APIs, moving it from a manual UI action to an integrable pipeline step. This allows developers to trigger reviews directly from scripts or internal tools rather than relying on the web interface. Simultaneously, the default effort level shifts to Balanced, striking a middle ground between speed and depth for most repositories. While Lite remains available for those prioritizing raw throughput, the API access is the real win here, enabling true CI/CD integration for automated code quality checks.
GitHub Changelog
© GitHub ChangelogMarket & Regulationother
npm trusted publishing configs expire in 48 hours
npm is tightening security on its trusted publishing feature by imposing a strict 48-hour expiration window for unvalidated configurations. This change directly targets supply chain risks where repository ownership changes could hijack trust relationships before they are fully vetted. Once a configuration successfully publishes, it becomes permanent, but any shift in project identity forces a fresh validation cycle. Additionally, tokens from GitHub Actions issue_comment events are now blocked, pushing developers toward safer triggers like push or release. This is a necessary hardening of the npm ecosystem that prioritizes security over convenience.
GitHub Changelog
More in Market & Regulation
Investment · $20m
Market & Regulationbusiness
Vocca raises $20m for patient call automation
Healthcare remains the final frontier for voice AI, and Vocca’s $20 million raise signals serious capital flowing into automating high-stakes phone interactions. Unlike generic assistants, this funding targets the messy reality of patient scheduling and triage, where accuracy and empathy are non-negotiable. It marks a shift from experimental chatbots to deployed voice agents handling critical administrative workflows. The market is watching to see if specialized vertical models can outperform generalist APIs in regulated environments.
Sifted
Investment · $40m
Market & Regulationother
Hadrian raises $40m for AI security
Hadrian has secured $40 million to defend against the rising tide of AI-powered cyberattacks. This funding signals a critical pivot in cybersecurity: as attackers leverage generative models to craft sophisticated phishing and malware, defenders must adopt equally advanced AI tools to keep pace. The investment validates the urgent need for automated, intelligent threat detection systems that can operate at machine speed. For security teams, this means the era of manual rule-based defense is ending, replaced by adaptive AI counters.
Sifted
© The Verge AIMarket & Regulationother
OpenAI faces backlash over math breakthroughs and ethics
OpenAI’s aggressive push into mathematics has triggered a severe reputational crisis within the academic community. After claiming solutions to major problems like Navier-Stokes using massive agent swarms, researchers accused the lab of unethical data practices and scooping peers. The company’s response—a new advisory panel—has been met with skepticism rather than relief. This exposes a fundamental clash between Silicon Valley’s speed-first culture and academia’s norms of transparency and collaboration. The real story isn't just the math; it's the institutional friction caused by AI labs treating research as a race. KleidiAI on Apple Silicon now compiles in default, meaning every M-series machine gets ARM-tuned GEMM kernels for free. ROCm 7.2 added as a default build narrows the AMD/CUDA gap visibly. There's no new model and no new quantization here — just llama.cpp quietly becoming the inference runtime for everyone who isn't on NVIDIA.
The Verge AI