GitHub’s Counterstrike: New Defenses Blunt Npm and Actions Supply Chain Assaults

GitHub’s Counterstrike: New Defenses Blunt npm and Actions Supply Chain Assaults

Attackers keep finding ways into open source projects. They phish maintainers. They twist CI/CD pipelines. Then they spread fast. But GitHub just shipped a series of changes that directly target those exact moves. The updates hit npm and GitHub Actions over recent months. They don’t promise perfection. They do break common attack paths. Disrupting the Attack Chain at Its Weak Points High-impact npm accounts now enter read-only mode for 72 hours …

Disrupting supply chain attacks on npm and GitHub Actions

In the past year, there’s been a pattern of supply chain attacks that target weaknesses in package repositories and CI/CD systems to quickly spread malware to hundreds of open source projects. This malware seeks to exfiltrate credentials both to broadly spread the attack, as well as for later exploitation. We’ve written a few times about our plans for hardening the supply chain: Our plan for a more secure npm supply chain in September 2025, Stre…