How GitHub Is Securing the Software Supply Chain

GitHub is accelerating security measures for the npm ecosystem after a wave of supply-chain attacks where attackers used phishing to compromise maintainers and inject malware into packages (initially 18 packages, later reports indicated nearly 500 compromised), including a self-replicating 'Shai-Hulud' worm that abuses post-install scripts. To mitigate risk, GitHub plans to require stronger authentication (FIDO-based 2FA), deprecate legacy tokens, shorten token lifetimes for publishing, introduce a Trusted Publishers program, and roll out these changes gradually with documentation and support.