{
  "id": 300759,
  "title": "GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing",
  "url": "https://urgent.news/2026/08/08/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-08T07:45:00.000Z",
  "source": {
    "name": "InfoQ",
    "slug": "infoq",
    "url": "https://www.infoq.com/news/2026/08/github-npm-actions-defaults/"
  },
  "original_language": "en",
  "account": "GitHub has implemented a series of security hardening measures across npm and GitHub Actions from March to July 2026, aiming to mitigate supply chain attacks which often involve a chain of weaknesses. Greg Ose, principal product security engineer, and Zachary Steindler, principal software engineer, noted that there is no single solution to these attacks and have focused on mitigations that disrupt the most impactful links.\n\nFor npm, high-impact accounts will be set to read-only for 72 hours following changes to their email address or 2FA recovery code. Additionally, when workflows check out untrusted fork code under commonly exploited triggers, GitHub Actions will no longer do so as the default behavior of actions/checkout. To prevent escalation, workflow execution policies allow administrators to govern who can trigger workflows and which trigger types are permitted. The Actions cache has also been set to read-only for untrusted triggers, closing a potential path for an attacker to poison shared cache entries to reach privileged release workflows.\n\nRegarding credential exfiltration, it is recommended to remove long-lived credentials from the pipeline and use npm trusted publishing that supports CircleCI. GitHub Actions network firewall is in technical preview, logging outbound traffic for unusual destinations. npm v12 will disable install scripts by default and disable dependencies fetched via git or remote URLs by default. Dependabot version updates will wait for three days before opening a pull request.\n\nCommunity reactions on Hacker News have been divided, with some arguing that time delays are an ineffective solution to the problem, while others claim that author-side package signing is the most effective mitigation, which GitHub has declined to implement for a decade due to potential deterrence of contributors.",
  "summary": "GitHub has implemented a series of changes across npm and GitHub Actions in an effort to strengthen its defenses against supply chain attacks. These updates, which have been rolled out between March and July 2026, prioritize mitigations that address the most significant vulnerabilities in the system. Among the most notable changes are the implementation of read-only high-impact accounts for 72 hours following changes to their email or 2FA recovery code on npm, and the modification of the default behavior of actions/checkout to prevent untrusted fork code from being checked out in GitHub Actions workflows, unless a team explicitly opts out. These measures are part of a broader strategy to break the chain of attacks that often involve multiple weaknesses.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Lobsters",
        "title": "GitHub Actions needs OIDC audience constraints",
        "url": "https://urgent.news/2026/08/10/github-actions-needs-oidc-audience-constraints",
        "published": "2026-08-10T13:30:18.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}