npm / GitHub Supply Chain Software Security Breach Litigation

This emerging class action targets Microsoft and its subsidiary GitHub over alleged security failures in the npm (Node Package Manager) registry and GitHub Actions continuous integration infrastructure. Plaintiffs contend that inadequate vetting and signing controls allowed threat actors to inject malicious packages into the npm ecosystem, compromising downstream applications used by enterprises, government agencies, and individual developers worldwide. Security researchers documented thousands of typosquatting and dependency-confusion packages harvesting credentials and tokens from automated build pipelines before they were removed.

The lawsuit claims Microsoft breached its duty of care and violated consumer protection statutes by misrepresenting the security posture of the world's largest software registry, which hosts more than 2.5 million packages downloaded billions of times each week. Plaintiffs seek compensatory damages for incident response costs, lost business, and reputational harm, as well as injunctive relief requiring cryptographic package signing and mandatory provenance attestation across the npm platform. The litigation remains in early stages as parties brief class certification issues.