Disrupting Supply Chain Attacks: Securing npm and GitHub Actions

Supply chain attacks are increasingly common, often starting with the compromise of a single project. Attackers may gain access by targeting a maintainer's account or exploiting vulnerabilities in the project's actions workflows. Recent improvements in npm and GitHub Actions are designed to cut off these common attack vectors and provide mechanisms for identifying and responding to such threats.

One key vulnerability is known as pwn requests, where workflows trigger on pull requests from forks, executing untrusted code. To combat this, trusted publishing allows you to authorize publishes to your package repository without relying on long-lived credentials. Additionally, staged publishing ensures that new packages on npm require further approval and 2FA authentication before they are published. The Actions network firewall logs all outbound network traffic from your Action workflow runs, helping you detect unusual behavior, such as pulling down malicious code or exfiltrating credentials.

In production, be aware that npm v12 will introduce a breaking change that disables install scripts by default, which can impact your workflows. Understanding these features and their configurations is essential to secure your CI/CD pipelines effectively.