Disrupting supply chain attacks on npm and GitHub Actions

GitHub's response to the wave of supply chain attacks that work by compromising maintainer accounts and CI/CD workflows rather than the code itself. The measures are concrete and mostly about adding friction where attackers need speed: account-protection delays on high-impact npm accounts, staged publishing behind additional authentication, safer defaults when Actions workflows check out untrusted code, read-only caches for untrusted workflows, and credential revocation tooling for incident response. The two changes with the widest reach are npm v12 disabling install scripts by default and a three-day cooldown on Dependabot updates, which gives the ecosystem time to catch a malicious release before automation pulls it everywhere. As npm package publishers ourselves, we read the publishing changes as friction worth paying.