npm and PyPI Registry Attacks

A free Artifactory plugin can hold npm and PyPI versions until they age in public

Shai-Hulud is on its fourth iteration. Trivy, Axios and LiteLLM have all shipped compromised releases. ReversingLabs is giving away a plugin that checks every package request against a reputation index inside Artifactory itself.