cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Traces Repeated npm Releases to a DefinitelyTyped Workflow Bug

· Original article ↗

Summary

StepSecurity traced repeated deprecated @types package releases on npm to a DefinitelyTyped workflow bug that published a new version every 30 minutes. A one-line fix stopped the loop.

Key points

  • StepSecurity’s monitoring flagged a surge of releases across several @types packages on February 17, 2026.
  • Some packages received more than 50 identical deprecated releases within 24 hours, with no code changes between versions.
  • The releases traced to the DefinitelyTyped-tools publish-packages.yml GitHub Actions workflow, which runs every 30 minutes.
  • A JavaScript bug passed undefined instead of the "latest" label, preventing the workflow’s check from recognizing packages already deprecated.
  • A one-line fix restored the default label and stopped repeated publishing; the issue was raised and merged on February 17.
  • StepSecurity described the releases as benign but said anomalous publishing can create noise that could camouflage suspicious activity.

Article Details

Event Type
Benign automation bug in a scheduled GitHub Actions workflow caused repeated deprecated npm package releases.
Impact
Several @types/ packages received dozens of identical deprecated versions without code changes. The repeated releases created supply-chain monitoring noise, but the article reports no malicious activity or compromised packages. The workflow bug was fixed the same day.

People

jakebaileyDefinitelyTyped-tools maintainer who diagnosed the workflow bug, opened a fix, and got it reviewed and merged.

Vendors

StepSecurityOn February 17, 2026, StepSecurity AI Package Analyst flagged something unusual: a sudden flood of version releases across several well-known @types/ packages on npm — including @types/mapbox__point-geometry,

Products

GitHub ActionsDigging deeper, we traced all the releases back to a single GitHub Actions workflow: microsoft/DefinitelyTyped-tools → publish-packages.ymlnpmsomething unusual: a sudden flood of version releases across several well-known @types/ packages on npm — including @types/mapbox__point-geometry, @types/tar, and others. What started as an anomaly alert turnedTypeScript@types/ packages on npm are community-maintained TypeScript type definitions for JavaScript packages that don't ship their own types, hosted on DefinitelyTyped. As more packages began bundling types natively, their

Tools

StepSecurity AI Package AnalystOn February 17, 2026, StepSecurity AI Package Analyst flagged something unusual: a sudden flood of version releases across several well-known @types/ packages on npm — including @types/mapbox__point-geometry,

Related Articles