GitHub 已禁用 npm 包的自动脚本执行功能，该功能允许包在安装时运行代码。此更改是由于‘Shai-Hulud’蠕虫利用了此功能进行传播恶意代码。此举旨在通过阻止在安装包期间未经授权的代码执行来增强 npm 生态系统的安全性。 AI
排序理由 一个平台（GitHub）对一个工具（npm）进行了更改以提高安全性。
AI 生成摘要 · Google Gemini · 来自 1 个来源。 我们如何撰写摘要 →
GitHub 在蠕虫利用后禁用 npm 自动运行脚本
本文如何被排名
- Signal score
- 0 / 100
- Composite score across the factors below. Higher = stronger signal that this story matters right now.
- Newsworthiness bucket
- Tool
- 一个平台（GitHub）对一个工具（npm）进行了更改以提高安全性。
- Source corroboration
- Single-source cluster
- Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
- Topics
- safety, product
- Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
- AI-industry relevance
- Standard
- On-topic for AI-industry coverage; kept in the public index.
- Story freshness
- 119 days old
- Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.
完整方法见我们的编辑标准。
报道来源 [1]
-
GitHub 暂停 npm 自动运行脚本
Shai-Hulud worm exploited exactly this. Better late than never, says everyone except the malware authors