GitHub Actions to securely publish npm packages

GitHub Actions' Package Manager Lacks Critical Security Features

The article investigates GitHub Actions' dependency resolution system, revealing it functions as a package manager but lacks critical securi

The case for GitHub Actions security after recent supply chain attacks

Open-Source Tool Provides Interactive Web Terminal for Debugging Failed GitHub Actions

The article presents a free, open-source tool that enables developers to launch an interactive web terminal into their GitHub Actions when b

NPM Security Best Practices Guide for Preventing Supply Chain Attacks

This GitHub repository provides comprehensive security best practices for NPM (Node Package Manager) to protect against supply chain attacks

Post-mortem Analysis of @ctrl/tinycolor npm Supply Chain Attack via GitHub Actions

A detailed post-mortem analysis of a supply chain attack on the @ctrl/tinycolor npm package. The attack occurred when a malicious GitHub Act

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data