In response to the recent supply chain attack in the JavaScript package manager npm, GitHub has made a few changes that will enable stronger security.
The attack on the npm ecosystem was caused by a worm, named Shai-Hulud, that infects and republish other packages with its malware to spread it across the npm ecosystem.
“By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers,” GitHub wrote in a blog post.
GitHub initially responded by removing over 500 compromised packages from the npm registry and blocking the upload of new packages that contain Indicators of Compromise (IoCs) associated with the malicious packages.
Now, the company is announcing upcoming changes to authentication and publishing options that will reduce the risk of token abuse and self-replicating malware. It will require two-factor authentication (2FA) for local publishing, reduce the lifetime of granular tokens to seven days, and utilize Trusted Publishers, which further reduces the usage of long-lived tokens or credentials for authenticating with package repositories.
“When npm released support for trusted publishing, it was our intention to let adoption of this new feature grow organically. However, attackers have shown us that they are not waiting. We strongly encourage projects to adopt trusted publishing as soon as possible, for all supported package managers,” GitHub wrote.
Additionally, to further improve npm security specifically, GitHub will deprecate legacy classic tokens, deprecate time-based one-time password 2FA, set publishing access to disallow tokens by default, and expand providers for trusted publishing.
Understanding that some of these changes will disrupt existing development workflows, GitHub plans to roll out changes gradually and will provide a later update with more specific timelines for each change along with documentation, migration guides, and support channels.
“True resilience requires the active participation and vigilance of everyone in the software industry. By adopting robust security practices, leveraging available tools, and contributing to these collective efforts, we can collectively build a more secure and trustworthy open source ecosystem for all,” GitHub said.
