Strengthening Open Source Supply Chain Security in the GitHub Environment

Recent open source supply chain attacks are evolving to compromise GitHub Actions workflows and steal secrets such as API keys. Attackers use the stolen information to distribute malicious packages and spread the attack further.

Users can take the following measures immediately to improve security.

• Enable CodeQL to review security best practices in workflow implementations.
• Avoid using pull_request_target when triggering workflows.
• Pin third-party Actions to a full-length commit SHA.
• Use Dependabot and the Advisory Database to detect malicious dependencies.

GitHub supports trusted publishing, which uses OpenID Connect (OIDC) tokens instead of secrets. This is supported by major package registries such as npm, PyPI, NuGet, and RubyGems, removing secrets from build pipelines and providing security signals.

In particular, for npm, given the scale of tens of thousands of packages published daily, malicious code is scanned for, and when detected, expert review is conducted before action is taken. In response to the Shai-Hulud attack, GitHub is overhauling its npm security roadmap, and will continue to update the security roadmap for GitHub Actions as well.