Landian News: GitHub requires first successful publish within 48 hours for new npm Trusted Publishing configs, closing a repo-name reuse (SlugFest) window; issue_comment tokens are rejected. Tighten ad/landing release pipelines accordingly.
Landian News relays Bitdefender’s Midnight Mimosa report: preinstalled malware on cheap Androids can click ads and register devices as TCP relays (residential proxies). For overseas ads, some ‘human’ egress was never clean—detection and containment, not exploit detail.
Landian News: OpenAI enables textGrain invisible text watermarks for ChatGPT/Codex in the EU; detectors stay non-public for now. For creatives and landings, machine-readable AI provenance is arriving—boundaries and ops notes.
Landian News relays Google Threat Intelligence: a Mandiant analyst joined TeamPCP’s CanisterWorm core chat, helping revoke stolen credentials and tip law enforcement. For ad-tech stacks on npm, the lesson is credential lifespan—not the thriller plot.