supply chain security

GitHub's npm registry makes staged publishing generally available: packages must pass a human-approved, 2FA-gated queue before consumers can install them.

The new public-preview command installs, pins, updates, and publishes portable skills for Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity — with git-backed provenance and an explicit prompt-injection warning.

Canonical has joined the Rust Foundation at the Gold membership tier, pledging $150,000 annually to support language governance and ecosystem security as Ubuntu 26.04 LTS prepares to ship with Rust-based coreutils and sudo by default.

The US and Japan enacted a critical minerals action plan on March 19 featuring price floors and four joint projects as neodymium prices doubled year-to-date and a $12 billion US strategic stockpile takes shape.

Check Point Research disclosed two CVEs in Anthropic's Claude Code that turned project configuration files into attack vectors, enabling remote code execution and API key exfiltration before users could approve a trust dialog.

IBM's annual threat index finds vulnerability exploitation now causes 40% of breaches, with 109 ransomware groups active and over 300,000 AI platform credentials stolen.