GitHub adds npm & Actions safeguards that choke supply‑chain attacks
GitHub has deployed new defenses in npm and GitHub Actions that block two of the most common supply‑chain attack vectors. High‑impact npm accounts now go read‑only for 72 hours after credential changes, and the actions/checkout default now refuses to pull untrusted code from forked pull requests. These steps give maintainers time to remediate and curb malware spread across the open‑source ecosystem.