Skip To Main Content
Xavier René-Corail on Muck Rack

Xavier René-Corail

As seen in: The GitHub Blog
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Xavier

Contact Xavier, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Our plan for a more secure npm supply chain

|
By Xavier René-Corail
| The GitHub Blog
Home / Security / Supply chain security Addressing a surge in package registry attacks, GitHub is strengthening npm’s security with stricter authentication, granular tokens, and enhanced trusted publishing to restore trust in the open source ecosystem. ·@xcorail September 22, 2025 | 4 minutes Share: Open source software is the bedrock of the modern software industry. Its collaborative nature and vast ecosystem empower developers worldwide, driving efficiency and progress at an unprecedented scale.
Open in Who Shared Issue with article?

The GitHub Security Lab’s journey to disclosing 500 CVEs in open source projects

|
By Xavier René-Corail, Michael Stepankin, Peter Stöckli, Kevin Stubbings
| The GitHub Blog
When I stepped onto the scale this morning, I remembered that there are some numbers that feel awkward to celebrate, while perhaps some others are worth celebrating! Recently, the GitHub Security Lab passed the milestone of 500 CVEs disclosed to open source projects. What’s a CVE? In short, it’s the record of a security vulnerability, under the CVE program, intended to inform impacted users. So, finding more vulnerabilities in open source shouldn’t be good news, right?
Open in Who Shared Issue with article?
See all 2 articles