--- title: GitHub Hardens npm and Actions Defaults, Drawing Debate... description: GitHub summarized supply chain security changes shipped to npm and GitHub Actions between March and July 2026. Key changes include a 72-hour read-only freeze... canonical: https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing | daily.dev og:description: GitHub summarized supply chain security changes shipped to npm and GitHub Actions between March and July 2026. Key changes include a 72-hour read-only freeze... og:url: https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa og:image: https://api.daily.dev/og/posts/VeLRggPFA.png og:image:alt: GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing **[InfoQ](https://daily.dev/sources/infoq)** · 5 min read · 0 upvotes · 0 comments ## Summary GitHub summarized supply chain security changes shipped to npm and GitHub Actions between March and July 2026. Key changes include a 72-hour read-only freeze on high-impact npm accounts after email or 2FA recovery changes, actions/checkout now blocking untrusted fork code by default, workflow execution policies, a read-only Actions cache for untrusted triggers, npm staged publishing requiring additional approval and 2FA, npm v12 disabling install scripts and remote-URL dependencies by default, and Dependabot waiting three days before opening PRs. Trusted publishing now supports CircleCI. Community debate on Hacker News centered on whether time delays are the right instrument versus author-side package signing, which npm has reportedly declined to implement for a decade. Critics argue delays are a low-tech workaround, while defenders note they work without maintainer participation and buy scanners time. The strongest protections — staged and trusted publishing — remain opt-in and unevenly adopted. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does npm v12 disable by default for supply chain security? npm v12 disables install scripts by default and also blocks dependencies fetched via git or remote URLs. This is a breaking change for builds that never audited what runs at install time, since those scripts will no longer execute automatically on install without explicit opt-in. _Teams shipping npm packages track breaking changes like this on daily.dev before they hit production pipelines._ ### How does npm trusted publishing prevent a compromised workflow from publishing a malicious package? Trusted staged publishing requires an attacker to independently compromise the workflow AND complete a separate 2FA flow as a maintainer. The workflow itself never holds any keys that can publish independently, so a single point of compromise is not enough. Triggering the specific publish workflow also leaves a traceable record on GitHub. _Developers hardening their npm release pipelines find the tradeoffs between these controls discussed on daily.dev._ ### Why does GitHub's 72-hour npm account freeze draw criticism from the security community? Critics argue 72 hours is too short because maintainers travel or fall ill and may not notice an attack within that window, while others point out that buying an expired author email domain for eight dollars would allow a full account takeover via password reset — making any cooldown period irrelevant. Some argue the real fix is author-side package signing, which npm has declined to implement for a decade. _Developers following the npm supply chain signing debate keep up with it on daily.dev._ ## Similar posts on daily.dev - [GitHub finally pulls the plug on automatic install script execution for npm](https://daily.dev/posts/github-finally-pulls-the-plug-on-automatic-install-script-execution-for-npm-lq84iidjt) · InfoWorld · 1 upvotes · 0 comments - [npm now freezes high-impact accounts after risky account changes](https://daily.dev/posts/npm-now-freezes-high-impact-accounts-after-risky-account-changes-k0mcnquls) · Aikido Security · 3 upvotes · 0 comments - [npm adds preventive account protection for high-impact accounts](https://daily.dev/posts/npm-adds-preventive-account-protection-for-high-impact-accounts-zkzboizhc) · GitHub Changelog · 3 upvotes · 1 comments - [npm Supply Chain Security: How Fastify Locked Things Down](https://daily.dev/posts/npm-supply-chain-security-how-fastify-locked-things-down-y51rgovbl) · Backend Cafe · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing","url":"https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa"},"datePublished":"2026-08-08T07:47:14.540Z","dateModified":"2026-08-24T06:53:50.907Z","description":"GitHub summarized supply chain security changes shipped to npm and GitHub Actions between March and July 2026. Key changes include a 72-hour read-only freeze...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1cd8116ca76b3ec013b220425ea88fb6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1cd8116ca76b3ec013b220425ea88fb6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github-actions,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github-hardens-npm-and-actions-defaults-drawing-debate-over-delays-versus-signing-velrggpfa#faq","mainEntity":[{"@type":"Question","name":"What does npm v12 disable by default for supply chain security?","acceptedAnswer":{"@type":"Answer","text":"npm v12 disables install scripts by default and also blocks dependencies fetched via git or remote URLs. This is a breaking change for builds that never audited what runs at install time, since those scripts will no longer execute automatically on install without explicit opt-in. Teams shipping npm packages track breaking changes like this on daily.dev before they hit production pipelines."}},{"@type":"Question","name":"How does npm trusted publishing prevent a compromised workflow from publishing a malicious package?","acceptedAnswer":{"@type":"Answer","text":"Trusted staged publishing requires an attacker to independently compromise the workflow AND complete a separate 2FA flow as a maintainer. The workflow itself never holds any keys that can publish independently, so a single point of compromise is not enough. Triggering the specific publish workflow also leaves a traceable record on GitHub. Developers hardening their npm release pipelines find the tradeoffs between these controls discussed on daily.dev."}},{"@type":"Question","name":"Why does GitHub's 72-hour npm account freeze draw criticism from the security community?","acceptedAnswer":{"@type":"Answer","text":"Critics argue 72 hours is too short because maintainers travel or fall ill and may not notice an attack within that window, while others point out that buying an expired author email domain for eight dollars would allow a full account takeover via password reset — making any cooldown period irrelevant. Some argue the real fix is author-side package signing, which npm has declined to implement for a decade. Developers following the npm supply chain signing debate keep up with it on daily.dev."}}]} ```