EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Jul 29·5 min read
Disrupting supply chain attacks on NPM and GitHub Actions
TL;DR
Recent enhancements to npm and GitHub Actions aim to disrupt supply chain attacks that exploit vulnerabilities in package repositories and CI/CD systems, significantly improving security for open source projects.
✦ Why It Matters
Review and update your security practices for npm and GitHub Actions to mitigate supply chain risks.
Key Takeaways
- Implement read-only mode for high-impact npm accounts.
- Adopt safer defaults for GitHub Actions workflows.
- Utilize staged publishing to enhance package security.
- Leverage self-service credential revocation tools for incident response.
How It Works
The updates to npm and GitHub Actions include mechanisms like a 72-hour read-only mode for account changes, which prevents immediate exploitation. Additionally, safer defaults for workflow triggers in GitHub Actions limit the execution of untrusted code, while staged publishing requires extra approval for package releases, effectively decoupling CI/CD credentials from publishing rights.