GitHub Boosting Security in Response to NPM Supply Chain Attacks

GitHub has announced tighter authentication and publishing rules in response to recent NPM supply chain attacks, including local publishing with mandatory 2FA, granular tokens that expire after seven days, and trusted publishing. The Shai-Hulud self-replicating worm attack highlighted the risk, as attackers compromised 195 packages and pushed more than 500 malicious package versions to the registry.

A week earlier, 18 NPM packages maintained by Josh Junon were injected with malware after the maintainer fell victim to a phishing campaign, with those packages drawing over 2.5 billion weekly downloads. In July, multiple packages with combined weekly downloads of over 30 million were poisoned after attackers used typosquatting to impersonate the Node.js package registry.

According to GitHub, the Shai-Hulud attack prompted swift action to remove malicious packages and block the upload of new malware that could have increased infections. The platform will deprecate legacy classic tokens and time-based one-time password 2FA, shorten granular token expiration for publishing, disallow tokens by default for publishing, prevent 2FA bypass for local publishing, and expand eligible providers for trusted publishing, with a gradual rollout to minimise disruption.