GitHub signals npm install changes to curb supply chain attacks

GitHub has announced changes to npm install in the upcoming major release scheduled for July. The changes respond to recent months of supply chain attacks that used npm install to spread malicious code through repositories. The changes are already available behind warnings, and GitHub recommends running version 11.16.0 or later and reviewing the warnings to prepare for the npm v12 release.

What this means for your organisation

This is both a security improvement and a scheduled disruption. If you build software, npm v12 will break setups that currently rely on behaviour being removed. The good news is you can find out now rather than when the build pipeline stops in July. If development is outsourced, this should already be on your supplier's radar.

Berigo recommends

• Upgrade to npm 11.16.0 or later in your build environments and read the warnings that appear.
• Set aside development time before July to address what the warnings flag.
• Raise npm v12 with external development suppliers and ask for a transition plan.
• Use the occasion to review which packages your builds actually pull in, and from where.

Source

• github.blog