Posted by ezraax on Sep 23 Hi, Sharing a registry-metadata observation that matters for supply-chain incident response. I audited npm's public package documents and found a retention asymmetry. Each package document has a `time` map (per-version publish stamps) and a `versions` map (the manifests).
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/887
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis via Static Graph and LLM Distillation
arXiv:2609.28996v1 Announce Type: new Abstract: The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages…
Adobe security advisory (AV26-808) – Update 2
Serial number: AV26-808 Date: August 12, 2026 Updated: September 24, 2026 As of August 11, 2026, Adobe is affected by vulnerabilities in the following products: Adobe…
Securing GenAI in the Real World: Assessing a Structured GenAI Implementation with Amazon Bedrock
Securing GenAI in the Real World: Assessing a Structured GenAI Implementation with Amazon Bedrock September 24, 2026 Mukhtar Kabir Paige Harlan BLOG 5 min. Generative AI…
Malicious npm Packages That Evade Defenses
This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.
How tax policy can stop threat actors from breaching US water systems
The foundation for modern society in America is under attack. State and local governments, entities that often oversee critical natural resources, schools, and hospital…
Adobe security advisory (AV26-953)
Serial number: AV26-953 Date: September 23, 2026 As of September 22, 2026, Adobe is affected by vulnerabilities in the following products: AEM 6.5 Forms JEE Prior to or…