Measures Against Supply Chain Attacks on npm and GitHub Actions
New security measures announced to protect open source projects.
1Anatomy of Supply Chain Attacks
Over the past year, supply chain attacks targeting weaknesses in package repositories and CI/CD systems have increased. These attacks use malware that quickly spreads to hundreds of open source projects. Attackers steal credentials to both propagate the attack and store them for later use. The npm and GitHub Actions teams have implemented various improvements to disrupt these attack techniques.
2Protection for High-Impact Accounts
In June 2026, npm introduced preventive protection measures for high-impact accounts. Maintainer accounts are put into read-only mode for 72 hours when they change their email or use a 2FA recovery code. This delay gives maintainers time to recover their accounts before an attack can be launched. This measure aims to prevent attacks that start with phishing campaigns.
3Secure Defaults for GitHub Actions
GitHub Actions changed the default behavior for pull_request_target triggers. Untrusted code from forks is no longer executed by default unless explicitly opted out. This change significantly reduces common security vulnerabilities in GitHub Actions CI/CD workflows that lead to code execution. Backported to older versions, this measure prevents initial project compromise.
4Workflow Trigger Controls
GitHub Actions added a new feature to control who and what can trigger workflows. Organizations and repositories can define policies on who is allowed to trigger workflows and what trigger types are permitted. These policies reduce the attack surface of CI/CD infrastructure while maintaining flexibility. Based on the principle of least privilege, this feature enhances security without sacrificing functionality.
5Read-Only Cache for Untrusted Triggers
After gaining code execution in a workflow, attackers attempt to escalate to more privileged workflows by poisoning shared cache entries. The new change restricts less trusted workflows from modifying the cache shared with other workflows. This directly prevents attackers from turning a limited-impact vulnerability into a compromise of highly privileged credentials used in release and publishing workflows.
6Eliminating Long-Lived Credentials
In April 2026, npm announced trusted publishing support for CircleCI. This feature eliminates the need for long-lived credentials in CI/CD pipelines. Without these credentials, which attackers attempt to exfiltrate, the attack chain is significantly disrupted. Trusted publishing provides a more secure alternative for authorizing package publishes.
7Detecting Anomalous Behavior with Network Firewall
GitHub Actions is introducing a network firewall feature currently in technical preview. This feature logs all outbound network traffic from workflow runs, enabling detection of anomalous behavior such as downloading malicious code or exfiltrating credentials to new domains. Future updates will include network egress restrictions and policies to block these attacks before they can spread further.
8Preventing Malware Spread with Staged Publishing
In May 2026, npm introduced staged publishing. With this feature, having credentials to publish a new package is not enough; packages remain staged until additional approval and 2FA authentication is provided via the npm cli or npmjs.com. This security control ensures that every published package version undergoes additional authorization. By decoupling CI/CD pipeline credentials from registry publishing, the attack chain from pipeline to malware distribution is severed.