GitHub moves to tighten npm security amid phishing, malware plague

GitHub, which owns the npm registry for JavaScript packages, says it is tightening security in response to recent attacks. September has been a bad month for npm with phishing attacks on package maintainers and hundreds of packages infected by secret-stealing malware. GitHub security lab lead Xavier René-Corail said that more …

[Joe W]

Wrong problem?

Pulling all dependencies for everything you build every single time is the problem.

Not having a stable version to develop against is the problem.

And this is bloody stupid.

[Taliesinawen]

Re: Wrong problem?

Continuous Instability and Continuous Dissemination of Malware (CI/CD):

What is CI/CD? “CI/CD, which stands for continuous integration and continuous delivery/deployment, aims to streamline and accelerate the software development lifecycle.”

[An_Old_Dog]

Re: Wrong problem?

Part of the problem is pulling dependencies for things you do not need to pull in order to build.

Many devs specify dependencies they do not need. WTF do they do this (I ask this in frustration and ignorance)?

[Paul Hovnanian]

Re: Wrong problem?

Left over "require" statements to support code that may have been pulled out somewhere in the revision history of the application.

A good IDE will highlight unused statements. But not all IDEs are good. Nor are the developers hired on later for maintenance.

[Anonymous Coward]

Re: Wrong problem?

Here, have 100 more upvotes.

Imagine a pipeline that performs a task. It runs repeatedly with different input test data. The stupid CI/CD system downloads the same 30MB of dependencies for every run. If you run yours in the cloud, you deserve the bills you're paying. Imagine how much quicker it would complete if it only had to compile the #*%#*! application once at the start of the tests.

[Anonymous Coward]

Re: Wrong problem?

“ René-Corail also described changes that he hopes will strengthen security. Many existing authentication methods will be removed "in the near future," including legacy classic tokens and one-time passwords for two-factor authentication (2FA). Token lifetimes will also be shortened, with a switch to trusted publishing and 2FA-enforced local publishing by default.”

Is your problem that doing this as a reaction and not long already done.

The other problem is pulling from a central repository badly secured, instead of from a vetted local library.

These agile fuckers …. <doublepicard>

[Anonymous Coward]

GitHub to be Banned for Under-16s

To add insult to injury, here in Australia, our eSafety Commissioner (who is implementing Australia's version of the OSA, which is fairly similar to the UK's version) has just added GitHub to the list of 'social media' sites from which under-16s will be banned. GitHub! FFS!!

https://www.abc.net.au/news/2025-09-24/digital-dilemna-social-media-age-ban-platforms/105807302

Is there anyone left who thinks the social media ban has anything to do with protecting kids?