--- title: Disrupting supply chain attacks on npm and GitHub Actions description: GitHub has shipped multiple security improvements to npm and GitHub Actions targeting supply chain attack techniques. Key changes include: npm's 72-hour... canonical: https://daily.dev/posts/disrupting-supply-chain-attacks-on-npm-and-github-actions-lskgc4rqs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Disrupting supply chain attacks on npm and GitHub Actions | daily.dev og:description: GitHub has shipped multiple security improvements to npm and GitHub Actions targeting supply chain attack techniques. Key changes include: npm's 72-hour... og:url: https://daily.dev/posts/disrupting-supply-chain-attacks-on-npm-and-github-actions-lskgc4rqs og:image: https://api.daily.dev/og/posts/LSKGC4rqS.png og:image:alt: Disrupting supply chain attacks on npm and GitHub Actions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Disrupting supply chain attacks on npm and GitHub Actions **[GitHub Blog](https://daily.dev/sources/ghblog)** · 8 min read · 0 upvotes · 1 comments ## Summary GitHub has shipped multiple security improvements to npm and GitHub Actions targeting supply chain attack techniques. Key changes include: npm's 72-hour read-only mode for high-impact accounts after sensitive changes, safer pull_request_target defaults to prevent pwn requests, read-only Actions cache for untrusted triggers, staged publishing for npm requiring additional 2FA approval, npm v12 disabling install scripts by default, Dependabot's new 3-day cooldown before opening version update PRs, CircleCI support for npm trusted publishing, an Actions network firewall in technical preview, and expanded self-service credential revocation APIs. These mitigations address the full attack chain from initial compromise through credential exfiltration and malware propagation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 34 comments across hackernews (as of 2026-08-05). **TL;DR:** The community is largely skeptical of npm/GitHub's new security measures, debating whether the 72-hour cooldown is too short and questioning whether these are meaningful solutions to a deeper ecosystem problem. **Sentiment:** 15% positive · 40% mixed · 45% skeptical **The case for** - Trusted publishing improves security by requiring an attacker to trigger a specific workflow on GitHub, leaving a traceable footprint. - Cooldowns are cheap to deploy and give scanners more time to detect malicious packages. - The npm security team can often remove poisoned releases independently of the maintainer. **The pushback** - 72 hours is seen by many as too short — people travel, get sick, or are away over weekends, and attackers deliberately strike on Fridays. - A cooldown is considered a low-tech band-aid when GitHub has access to sophisticated static analysis tools it could use instead. - npm is singled out as uniquely prone to these supply-chain issues compared to other language ecosystems. **By community** - hackernews (skeptical): Commenters are broadly critical of the 72-hour window and view the cooldown as an underwhelming response to a systemic npm security problem. **Hottest debate:** Whether 72 hours is a reasonable cooldown duration or dangerously too short given real-world maintainer availability. **Open questions** - What data-driven method should be used to pick the optimal cooldown duration? - Why isn't GitHub leveraging its code analysis capabilities for more sophisticated supply-chain protection instead of a simple time delay? - Does trusted publishing actually prevent attacks if the CI workflow itself is compromised? **Highlights** > There is a big difference between 3 days when someone may be sick or traveling and not looking and 30 which aligns better with 99% of scenarios this may be an issue with. 3 days is absurd. Even password apps with kill switches will default to 7 days. Cyber attacks will frequently happen on a Friday just for this scenario, they anticipate no ones looking over the weekend. > — [datakan on hackernews · 1 comments](https://news.ycombinator.com/item?id=49099173) > Github owns NPM. Github has unprecedented access to code analysis tools. Github can run static analysis on nearly everything. Introducing a cooldown period seems like the lowest tech solution to a technological problem I have seen in a longwhile. > — [summarybot on hackernews · 2 comments](https://news.ycombinator.com/item?id=49099169) > Trusted Publishing pins the publish to the workflow. The next step is to isolate "run untrusted code (`npm build`)" from "publish" in your workflows. Now you have two properties - the publish can only happen from one place and the publish is isolated from untrusted code execution. > — [insanitybit on hackernews](https://news.ycombinator.com/item?id=49100869) > And 365 days probably aligns with 100% of scenarios. It doesn't mean it's a good idea, because the longer the delay is the more downsides you also get. Blocking a maintainer from pushing updates for a full month after changing their e-mail would be obviously absurd. So Github would have to add a way of enabling maintainers to super-uper-duper confirm the change and cut the delay short. Which is likely not currently possible, hence starting with a shorter delay. > — [tredre3 on hackernews](https://news.ycombinator.com/item?id=49099514) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49096427) · 33 points · 34 comments ## Similar posts on daily.dev - [GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing](https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa) · InfoQ · 0 upvotes · 0 comments - [Securing the open source supply chain across GitHub](https://daily.dev/posts/securing-the-open-source-supply-chain-across-github-k6lf4rzyu) · GitHub Blog · 0 upvotes · 0 comments - [GitHub announces npm security changes to tackle supply-chain attacks](https://daily.dev/posts/github-announces-npm-security-changes-to-tackle-supply-chain-attacks-utlkr6lo8) · BleepingComputer · 0 upvotes · 0 comments - [GitHub finally pulls the plug on automatic install script execution for npm](https://daily.dev/posts/github-finally-pulls-the-plug-on-automatic-install-script-execution-for-npm-lq84iidjt) · InfoWorld · 1 upvotes · 0 comments --- Tags: [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm), [#secrets-management](https://daily.dev/tags/secrets-management), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/disrupting-supply-chain-attacks-on-npm-and-github-actions-lskgc4rqs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Disrupting supply chain attacks on npm and GitHub Actions","url":"https://daily.dev/posts/disrupting-supply-chain-attacks-on-npm-and-github-actions-lskgc4rqs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/disrupting-supply-chain-attacks-on-npm-and-github-actions-lskgc4rqs"},"datePublished":"2026-07-28T16:01:25.504Z","dateModified":"2026-10-14T02:35:04.746Z","description":"GitHub has shipped multiple security improvements to npm and GitHub Actions targeting supply chain attack techniques. Key changes include: npm's 72-hour...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/764c41b066307a71150eebfaf30aa004?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/764c41b066307a71150eebfaf30aa004?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/106cf162b88840808484d4b5429b59b1","url":"https://daily.dev/sources/ghblog"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/disrupting-supply-chain-attacks-on-npm-and-github-actions-lskgc4rqs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"cicd,github-actions,npm,secrets-management,security","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Blog","item":"https://daily.dev/sources/ghblog"},{"@type":"ListItem","position":3,"name":"Disrupting supply chain attacks on npm and GitHub Actions"}]} ```