GitHub tightens npm security with mandatory 2FA, access tokens

GitHub is introducing a set of defenses against supply-chain attacks on the platform that led to multiple large-scale incidents recently. Notable cyberattacks that started from compromising GitHub repositories and then spread to NPM include the "s1ngularity" attack in late August, the "GhostAction" campaign in early September, and the worm-style campaign dubbed "Shai-Hulud" from last week. The attacks led to the compromise of thousands of accounts and private repositories, the theft of sensitive data, and significant remediation costs. Although GitHub responded quickly to minimize the impact of these incidents, the developer platform admits that stronger proactive measures would be more effective. To reduce these risks, GitHub announced that it would gradually implement the following measures: Trusted publishing, already adopted across multiple ecosystems, is strongly encouraged as it eliminates the need to manage API tokens in build systems. NPM maintainers are advised to switch to trusted publishing immediately, as well as to enforce 2FA for publishing and writing, and use WebAuth instead of time-based one-time passwords (TOTP) for 2FA. The code hosting and collaboration platform will roll out these changes gradually and provide the necessary documentation and migration guides to minimize disruption to existing workflows. The announcement also stresses that ecosystem security is a collective duty, and developers are expected to take action themselves to mitigate supply-cha...