Welcome to HowToShipIt — practical how-to guides for developers: code, AI tools, and servers, explained step by step.
Trusted publishing was supposed to be the safe way to release npm packages. No long-lived token sitting in a CI secret store waiting to leak — just a short-lived credential minted at release time. On 13 October 2026, researchers at Bloom Security showed it could be abused anyway. They found more than 1,500 npm packages, … Read more
A campaign called GhostAction has compromised roughly 1,900 GitHub accounts and planted a credential-stealing workflow in more than 30,000 repositories. If you maintain anything on GitHub — especially if you got a mysterious new workflow file called security-audit.yml or github_actions_security.yml — you need to check your repos this weekend. Not next week. This weekend. This … Read more