GitHub and npm add safeguards to block common supply-chain attacks
GitHub and npm introduced two key defenses: npm now places high‑impact accounts in read‑only mode for 72 hours after an email change or 2FA recovery, buying time to stop credential theft; GitHub Actions’ checkout action now defaults to blocking untrusted code from fork‑origin pull‑request triggers. The tweaks cut off early‑stage compromise vectors in supply‑chain attacks.