CuraDevOps

tag: Account-Security · 1 items

Learn archived npm extends 72-hour security hold to all accounts after recovery-code sign-in
2026-09-11 · GitHub Changelog · source ↗ #npm#supply-chain-security#account-security
  • Platform/SRE — Skip
  • CI/CD — Learn: npm now applies a 72-hour security hold to any account following a recovery-code sign-in, broadening a protection previously limited to high-impact accounts; no pipeline changes are needed since CI automation should use tokens, not recovery codes, but this informs npm supply-chain security posture.
  • Leader — Skip