InfoQ - Security Vulnerabilities - News

npm Staged Publishing Available, Adding a Human Approval Step before Packages Go Live

Daniel Curtis — Fri, 07 Aug 2026 06:12:00 GMT

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags.

By Daniel Curtis

Wiz Discloses CosmosEscape, and Practitioners Debate What Customers Could Have Done

Steef-Jan Wiggers — Thu, 06 Aug 2026 09:21:00 GMT

Wiz Research disclosed CosmosEscape, a chain that escaped Azure Cosmos DB's Gremlin sandbox and reached a platform-wide key granting read and write access to every database on the service. Microsoft blocked the entry point within two days but took until July 2026 to remove the key. Practitioners debated shared responsibility and what that rearchitecture actually cost.

By Steef-Jan Wiggers