How npm packages get hijacked: checklist to protect yours 29 Jul 2026 How npm maintainers get phished and packages hijacked, and what to turn on today: OIDC trusted publishing, staged publishing, npm v12, Dependabot cooldown. Read article