GitHub is implementing comprehensive security measures to combat supply-chain attacks after experiencing several major incidents that compromised thousands of accounts and repositories.
## Recent Attack Wave Prompts Action
The platform faced three significant cyberattacks in recent months:
– **”s1ngularity” attack** (late August)
– **”GhostAction” campaign** (early September)
– **”Shai-Hulud” worm-style attack** (last week)
These attacks originated from compromised GitHub repositories and spread to NPM, resulting in thousands of compromised accounts, stolen sensitive data, and substantial remediation costs.
## New Security Measures
GitHub will gradually roll out the following protective measures:
**Authentication Enhancements:**
– Mandatory two-factor authentication (2FA) for local publishing
– Migration from classic tokens and TOTP 2FA to more secure FIDO-based authentication
– Removal of 2FA bypass options for local publishing
**Token Security:**
– Enforcement of granular tokens with 7-day lifespans
– Shortened expiration periods for publishing tokens
– Default settings that disallow token-based publishing access
**Trusted Publishing:**
– Expanded adoption of trusted publishing systems
– Elimination of API token management in build systems
## Developer Recommendations
GitHub strongly advises NPM maintainers to:
– Switch to trusted publishing immediately
– Enable 2FA for publishing and writing operations
– Use WebAuth instead of time-based one-time passwords (TOTP)
## Ruby Ecosystem Also Strengthens Security
Ruby Central announced tighter governance for the RubyGems package manager following similar security issues, including 60 malicious Ruby gems downloaded 275,000 times. The organization is implementing a more transparent, community-centered governance model.
## Collective Responsibility
GitHub emphasizes that ecosystem security requires collaborative effort from both the platform and developers. The company will provide comprehensive documentation and migration guides to ensure smooth transitions while minimizing workflow disruptions.
These proactive measures represent a significant shift toward preventing supply-chain attacks rather than merely responding to them after they occur.