GitHub Aims to Secure Supply Chain as NPM Hacks Ramp Up

GitHub has unveiled a plan to strengthen the NPM supply chain in response to recent package registry attacks, including the Shai-Hulud and Qix campaigns. On 22 September, a blog post by GitHub senior director of security research Xavier René-Corail outlined three core changes: only publishing packages locally with two-factor authentication, introducing granular tokens that last seven days, and adopting the Trusted Publishers authentication method.

In the wake of the Shai-Hulud worm, GitHub said it removed more than 500 compromised packages and blocked new packages containing the attackers’ indicators of compromise. The company also intends to deprecate legacy tokens, move to FIDO-based two-factor authentication, and broaden the set of providers for trusted publishing, with a gradual rollout to minimise disruption.

According to OpenSSF Securing Software Repositories Working Group, trusted publishing is a recommended security capability and has been adopted across several ecosystems since 2023. Analysts including Mike McGuire of Black Duck and Danny Allan of Snyk describe the changes as a meaningful step forward, while noting that token changes alone cannot completely eradicate such attacks.