GitHub reports on its measures against attacks on npm and GitHub Actions

2026-07-28 · Publisher : GitHub · Domain : Cloud & DevOps

On 28 July 2026, GitHub recaps the changes shipped to break attack techniques on npm and Actions: install scripts disabled by default in npm v12, staged publishing, a three-day Dependabot cooldown.

### Background On 28 July 2026, two GitHub engineers publish a review of the changes made to npm and GitHub Actions "over the past few months" to counter supply chain attacks. They follow a common pattern: initial compromise, propagation, then exploitation of stolen credentials. The post follows those of September 2025 and March 2026. ### Key facts - Initial compromise: high-impact npm accounts go read-only for 72 hours after an email change or a 2FA recovery code (June 2026); actions/checkout blocks fork code by default on risky triggers such as pull_request_target (June 2026). - Workflow execution policies (June 2026) and npm trusted publishing extended to CircleCI (April 2026); an Actions network firewall in technical preview, which logs outbound traffic. - Propagation: staged publishing on npm (May 2026), which requires approval with 2FA; npm v12 disables install scripts and Git or remote-URL dependencies by default. - Dependabot now waits three days before opening a version-update pull request, with security fixes remaining immediate (July 2026). - Incident response: revocation API extended to OAuth and app tokens (March 2026) and self-service revocation of an enterprise user's credentials (June 2026). ### Why it matters The post documents a change of stance: platforms are moving protections into safe defaults instead of leaving each team to configure them. For DevOps teams, this means adapting pipelines (script allowlists, staged-publishing tokens) before the defaults take effect, and getting the cooling-off benefit for free. For consulting firms, it is a good-practice reference to offer clients. ### Takeaway Protections against supply chain attacks move from advice to platform defaults.

Tags : Sécurité, CI/CD, Open Source, DevOps