StepSecurity incident
Some npm packages may return incorrect download URLs, causing installation failures.
Resolved after 43 minutes, affecting Secure Registry (Secure Registry), on September 28, 2026.
We identified a caching issue affecting metadata responses for some npm packages served through Secure Registry. Affected responses may contain package download URLs pointing to a different registry endpoint than the one configured by the customer. This may cause package installation or dependency resolution failures. The issue occurs when registry deployments share cached metadata containing deployment-specific download URLs. We have identified the root cause and are preparing a fix to isolate these cached responses by registry endpoint.
Affected components
Update timeline
- investigating Sep 28, 2026, 06:44 PM UTC
We identified a caching issue affecting metadata responses for some npm packages served through Secure Registry. Affected responses may contain package download URLs pointing to a different registry endpoint than the one configured by the customer. This may cause package installation or dependency resolution failures. The issue occurs when registry deployments share cached metadata containing deployment-specific download URLs. We have identified the root cause and are preparing a fix to isolate these cached responses by registry endpoint.
- resolved Sep 28, 2026, 07:27 PM UTC
The issue has been resolved, and all affected services are operating normally.
Your product runs on more than StepSecurity
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services