GitHub announced this a while back:
replyhttps://github.blog/changelog/2026-07-28-npm-publish-time-ma...
"A while back" -- One week ago.
replyI am curious if they are still implementing the process or if this particular attacker already figured out a way around it.
Ah, I see your problem there
reply> This requirement will be progressively enforced over time.
> I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.
replyMaybe that's the idea. Regards, the <insert your favourite 3 letter agency here>