Securing GitHub Actions

The typical playbook for a supply chain attack is to use some form of social engineering to compromise a maintainer’s account, then use that account to directly publish compromised packages to npm. Maintainers are fighting back by removing direct publishing credentials and moving to trusted publishing pipelines like GitHub Actions. Consumers are protecting themselves by verifying package integrity…