Record · corpus.blog/posts/01a0c528-cc14-700f-9ade-e288109f2001

Disrupting supply chain attacks on npm and GitHub Actions

GitHub · published 28 July 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at github.blog Wayback capture

1blogs citing

First cited: 5 Aug 2026
Most recent: 5 Aug 2026
Rank this month: not ranked
Links from this post: 19
Words captured: 1,479

Cited by

Blog

In the post

Date

Sonar Blog

The return of Shai-Hulud: How SonarQube detects and contains the npm worm Read at the source ↗

5 Aug 2026

Links from this post

Link

Host

https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

github.blog

https://github.blog/security/supply-chain-security/strengthening-supply-chain-security-preparing-for-the-next-malware-campaign/

github.blog

What’s coming to our GitHub Actions 2026 security roadmap Read at the source ↗

github.blog

https://github.blog/changelog/2026-06-25-npm-adds-preventive-account-protection-for-high-impact-accounts/

github.blog

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/

github.blog

https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/

securitylab.github.com

https://github.blog/changelog/2026-06-18-control-who-and-what-triggers-github-actions-workflows/

github.blog

https://github.blog/changelog/2026-06-26-read-only-actions-cache-for-untrusted-triggers/

github.blog

https://github.blog/changelog/2026-04-06-npm-trusted-publishing-now-supports-circleci/

github.blog

https://docs.npmjs.com/trusted-publishers

docs.npmjs.com

https://github.com/github-early-access/actions-native-egress-firewall/

github.com

https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/

github.blog

https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

github.blog

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

github.blog

https://github.blog/changelog/2026-06-24-self-service-credential-revocation-for-incident-response/

github.blog

https://github.blog/changelog/2026-02-17-enterprise-wide-credential-management-tools-for-incident-response/

github.blog

https://github.blog/changelog/2026-03-26-credential-revocation-api-now-supports-github-oauth-and-github-app-credentials/

github.blog

https://github.blog/changelog/2025-04-29-credential-revocation-api-to-revoke-exposed-pats-is-now-generally-available/

github.blog

https://github.blog/changelog/?label=supply-chain-security

github.blog