GitHub is rolling out significant security upgrades to npm and GitHub Actions designed to make supply chain attacks far harder to pull off. The changes target the most common vectors: compromised maintainer accounts and malicious code execution during package installation.
Maintainer accounts of popular packages will enter read-only mode for 72 hours whenever an email change or two-factor authentication recovery code is used. This grace period gives teams time to detect and respond to account takeovers before damage occurs. On the npm registry itself, newly published packages now sit in a holding state and require additional approval plus secondary authentication before going live to the public.
npm version 12 disables install scripts by default—a critical move since these scripts run with full system access during package setup. Developers who genuinely need install scripts can opt in, but the default-off approach blocks a major attack surface.
GitHub Actions workflows are also getting tighter controls. Workflows with lower trust levels can no longer modify caches shared with more privileged workflows, preventing lateral escalation. The actions/checkout action now refuses to check out untrusted code submitted via pull requests from forks, eliminating a pathway for injecting malicious changes into CI/CD pipelines.
These moves reflect growing pressure on GitHub and the npm ecosystem to harden defenses against the rising tide of software supply chain compromises.
