NPM publisher compromises rise

- Researchers and community posts report a spike in attackers compromising NPM publishers and swapping legitimate packages for trojanized malware, creating widespread downstream risk. - A SecWeekly video and commentator @aravindputrevu specifically called out publisher-account compromises and urged automation of dependency compliance to detect malicious replacements early. - The signal pushed engineers to adopt publisher verification, SBOMs, and automated checks to block trojanized updates before CI/CD ingestion. (x.com 1) (x.com 2)