Disrupting supply chain attacks on npm and GitHub Actions
Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact. The post Disrupting supply chain attacks on npm and GitHub Actions appeared first on The GitHub Blog .
In the past year, there has been a recurring issue of supply chain attacks targeting package repositories and CI/CD systems, such as npm and GitHub Actions. These attacks aim to quickly spread malware to numerous open-source projects, with the ultimate goal of exfiltrating credentials for further exploitation. The company has been working on several updates to disrupt these attacks and limit their impact.
Recent changes to npm and GitHub Actions include several improvements to address common supply chain attack techniques. For npm, the introduction of preventive account protection for high-impact accounts, such as requiring a 72-hour read-only mode after a maintainer changes their email or uses a 2FA recovery code, helps mitigate the initial compromise.
Additionally, GitHub Actions now has safer pull_request_target defaults for the actions/checkout component, preventing the checkout of untrusted code from forks in commonly exploited triggers.
To further secure GitHub Actions, a new policy allows users to control who and what triggers GitHub Actions workflows. This policy can be set at enterprise, organization, or repository levels to limit the risk of untrusted code execution. Another change restricts cache entries shared across workflows, closing a common path used by attackers to escalate privileges and compromise highly privileged credentials.
To prevent attackers from exfiltrating credentials, npm has introduced trusted publishing, which supports CircleCI as a trusted publishing provider. This allows users to authorize package repository publishes without long-lived credentials, thereby disrupting the attack chain. Moreover, staged publishing for npm, now available as an opt-in security control, ensures that packages are only published after additional approval and 2FA authentication.
Looking ahead, npm has planned several breaking changes for npm v12, which will further strengthen supply chain security. These updates aim to remove long-lived credentials from CI/CD pipelines and provide a more secure environment for all users. Collaboration with security research and developer communities has been key to implementing these changes and improving overall supply chain security.
Written by urgent.news from GitHub Blog's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
