GitHub & npm Supply Chain Attack Mitigation: Workflows, Credentials, and Release Protections

Vulnerability Overview This article discusses supply chain attacks targeting npm and GitHub Actions, which exploit weaknesses within the software ecosystem to rapidly disseminate malware across multiple open-source projects. Attackers initiate these attacks by compromising the accounts of project maintainers or the Actions workflows of target projects, attempting to extract credentials to further propagate the malware. Impact Scope npm packages: Attackers may disseminate malware through npm packages. GitHub Actions workflows: Attackers may leverage GitHub Actions workflows to execute malicious code. Open-source projects: Multiple open-source projects may be affected, resulting in malware dissemination and credential leakage. Mitigation Strategies 1. npm Package Protection: - Proactive Account Protection for npm Packages: High-impact npm accounts will enter a read-only mode for 72 hours until the email is changed or 2FA recovery codes are used to restore access. - Trusted Publishing for npm Packages: Support for CircleCI has been implemented, long-lived credentials have been removed, and the attack surface has been reduced. 2. GitHub Actions Workflow Protection: - Safer Default Pull Request Targets: By default, pull requests do not trigger Actions workflows unless explicitly allowed. - Control Who and What Triggers GitHub Actions Workflows: Policies can be set at the enterprise, organization, or repository level to restrict permissions for triggering workflows. - Read-Only Actions Cache for Untrusted Triggers: This limits the ability of untrusted workflows to modify shared caches. 3. Credential Extraction Prevention: - Trusted Publishing for npm Packages Supporting CircleCI: Long-lived credentials have been removed to reduce the attack surface. - Actions Network Firewall: Detects anomalous outbound network traffic, preventing malicious code downloads and credential extraction. 4. Attack Propagation Prevention: - Phased Publishing for npm Packages: Requires additional approval and 2FA authentication to ensure published versions are authorized. - Upcoming Breaking Changes in npm v12: Installation scripts will be disabled to prevent the execution of malicious code. - Default Package Cooling Period Introduced by Dependabot Version Updates: Introduces a waiting period of at least three days after a new version is released to allow time for signal detection. 5. Identification and Response to Supply Chain Attacks: - Self-Service Credential Revocation for Incident Response: Provides self-service tools to immediately revoke credentials involved in supply chain attacks. - Expanded Credential Revocation API Support: Supports GitHub OAuth and App tokens for rapid revocation of leaked credentials. Summary GitHub and npm are strengthening supply chain security through a series of measures, including account protection, workflow control, credential extraction prevention, attack propagation prevention, and identification and response mechanisms, aimed at mitigating the impact of supply chain attacks.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub & npm Supply Chain Attack Mitigation: Workflows, Credentials, and Release Protections