GitHub Implements Stricter npm Security Measures Following Major Supply-Chain Attacks

8 sources · Updated 5mo ago · First seen Sep 23, 2025

GitHub is rolling out enhanced security controls for the npm registry after a series of high-profile supply-chain attacks. Key changes include mandatory two-factor authentication, deprecation of legacy tokens, shorter token lifetimes, and the adoption of trusted publishing workflows. These measures aim to mitigate risks from recent incidents that compromised thousands of accounts and packages.

Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Sep 23, 2025

Sep 23, 20251y ago
GitHub announces tighter npm publishing and authentication security
GitHub announced new npm security measures including stronger authentication requirements for publishers, expanded use of access tokens, and policy changes aimed at reducing phishing, account takeover, and malicious package publication. Multiple reports describe the move as a response to rising npm-focused attacks and the Shai-Hulud incident.
Sep 23, 20251y ago
Shai-Hulud supply-chain attack targets npm ecosystem
A supply-chain campaign dubbed Shai-Hulud emerged in the npm ecosystem, using malicious packages and related compromise activity that raised concern about software publishing security. Coverage describes it as a catalyst for broader scrutiny of npm account protection and package release integrity.

Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.

Check your exposure

Source coverage

Sources

8 references tracked. Mallory keeps watching after this page renders.

Reversing Labs BlogNews · Sep 24, 2025

Shai-hulud supply chain attack: Don’t let worms eat DevOpsOpen source ↗

Techrepublic Com SecurityNews · Sep 24, 2025

How GitHub Is Securing the Software Supply ChainOpen source ↗

ScworldNews · Sep 24, 2025

GitHub to update npm authentication, publishing policiesOpen source ↗

GitHub moves to tighten npm security amid phishing, malware plagueOpen source ↗

Bleeping ComputerNews · Sep 23, 2025

GitHub tightens npm security with mandatory 2FA, access tokensOpen source ↗

Dark ReadingNews · Sep 23, 2025

GitHub Aims to Secure Supply Chain as NPM Hacks Ramp UpOpen source ↗

Help Net SecurityNews · Sep 23, 2025

After Shai-Hulud, GitHub tightens npm publishing securityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

GitHub Implements Stricter npm Security Measures Following Major Supply-Chain Attacks

How this story unfolded

GitHub announces tighter npm publishing and authentication security

Shai-Hulud supply-chain attack targets npm ecosystem

Sources

See the full picture, correlated to your attack surface.

Related stories

Recent npm Supply Chain Attacks and Security Enhancements

GitHub Adds Suspicious Actions Holds and npm Publish-Time Malware Gating

npm 12 and pnpm 11.10 tighten package install and registry token security

GitHub Implements Stricter npm Security Measures Following Major Supply-Chain Attacks

How this story unfolded

GitHub announces tighter npm publishing and authentication security

Shai-Hulud supply-chain attack targets npm ecosystem

Sources

See the full picture, correlated to your attack surface.

Related stories

Recent npm Supply Chain Attacks and Security Enhancements

GitHub Adds Suspicious Actions Holds and npm Publish-Time Malware Gating

npm 12 and pnpm 11.10 tighten package install and registry token security