Learn
archived
npm extends 72-hour security hold to all accounts after recovery-code sign-in
- Platform/SRE — Skip
- CI/CD — Learn: npm now applies a 72-hour security hold to any account following a recovery-code sign-in, broadening a protection previously limited to high-impact accounts; no pipeline changes are needed since CI automation should use tokens, not recovery codes, but this informs npm supply-chain security posture.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.