GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

GitHub announced changes aimed at strengthening the npm supply chain, including local publishing with required two-factor authentication (2FA) and granular tokens with a seven-day lifetime, plus trusted publishing that uses OpenID Connect to secure CI/CD workflows. The plan also deprecates legacy classic tokens and migrates users from TOTP 2FA to FIDO-based 2FA, while publishing access will default to restricted tokens unless a user is a trusted publisher or uses 2FA-enforced local publishing.

This move follows a wave of npm supply chain attacks, including the Shai-Hulud incident, and is designed to prevent token abuse and self-replicating malware by ensuring cryptographic proof of source and build environment for each publish, with provenance attestations generated automatically by the npm CLI.

The changes come as GitHub expands trusted publishing and narrows token usage, and were highlighted after a malicious package named fezbox was identified, which attracted 476 downloads since first publishing on 21 August 2025; the threat actor behind fezbox is described as npm alias janedu with registration email janedu0216@gmail[.]com. According to GitHub, these measures will help secure the npm ecosystem by enabling verifiable, short-lived credentials that cannot be exfiltrated or reused.