@Aqua Security

Supply chain attacks on npm and GitHub Actions are exploiting the gap between malicious package publication and CVE issuance, with attackers publishing compromised versions that are installed by thous…