In an effort to strengthen the security of the software supply chain, GitHub has implemented new controls for npm that allow maintainers to specifically authorize a release before the packages are made available for public installation.
The capability, known as staged publishing, is currently widely accessible on npm. Before a package is published to npmjs[.]com, it requires a human maintainer to successfully complete a two-factor authentication (2FA) challenge.
The prebuilt tarball is submitted to a stage queue where a maintainer must specifically approve it before it becomes installable, as opposed to a straight publication that instantly makes a package version available to users, according to GitHub.
According to the Microsoft-owned company, the modification guarantees “proof of presence” for each publish, including those resulting from trusted publishing with OpenID Connect (OIDC) authentication and non-interactive CI/CD workflows read more about npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.