GitHub shipped four supply chain security changes in October 2026: an install-time firewall for npm packages, an expiry rule for unused npm trusted publishing configurations, push attribution for commits and AI security scanning on pull requests. Each targets a different weak point, and they land in different plans and preview stages.
Which GitHub supply chain security control should you turn on first? Audit your npm trusted publishing setup this week, because the expiry rule is already live and the flaw behind it is serious. If you are on GitHub Enterprise Cloud, pilot the package firewall in front of CI runners and coding agents next.
Why do npm trusted publishing configurations now expire?
On 2 October, GitHub said that npm trusted publishing configurations that are never validated lapse 48 hours after creation and can no longer authorise publishing. A configuration is validated by its first successful publish, and validated configurations do not expire. Changing the repository or project identity starts a new 48-hour window.
npm also now rejects trusted publishing tokens from GitHub Actions issue_comment events, on top of the existing pull_request_target restriction. Workflows that publish from those events need to move to push, release or workflow_dispatch.
The reason is a flaw Bloom Security reported in June. Help Net Security reported that npm identified linked repositories by owner and name only. If the repository was renamed, transferred or deleted, an attacker could claim the freed name and publish someone else's package, with a valid provenance attestation. Bloom counted more than 1,500 exposed packages with over 10 million total downloads.
Run npm trust list and check that every repository listed still belongs to you.
What does the GitHub package firewall do?
Announced in public preview on 20 October, the package firewall sits between your endpoints and upstream registries and inspects metadata requests and downloads before anything installs. Policies can check the GitHub Advisory Database for malware and vulnerability advisories, flag attestation downgrades and enforce a cooldown period on new versions.
GitHub said CI runners and coding agents are the main concern because they install dependencies with no human looking at each step. It covers npm only for now. It is open to all GitHub Enterprise Cloud customers, free during preview and metered at general availability. Blocked packages can be released through an exception request.
Push attribution names the account that pushed
Git author and committer fields are set by the client, so anyone with write access can claim to be someone else. Push attribution, in limited preview for GitHub Enterprise since 12 October, records the authenticated pusher on each commit in the UI and API.
A new ruleset condition can block pushes where the committer email does not match one of the pusher's verified addresses. Audit release bots, shared tokens and maintainers pushing contributor branches before you enforce it. Enterprise customers must ask their account team to join.
AI Scan covers files CodeQL cannot
GitHub made AI Scan for pull requests generally available on 15 October. It looks for vulnerabilities in languages and file types CodeQL does not cover, including PHP, shell scripts, Terraform and Dockerfiles. Findings carry an AI label and can include a suggested fix.
The findings are advisory. They do not fail the check and rulesets cannot use them to block a merge. Public repositories are included. Private and internal repositories need GitHub Code Security or GitHub Advanced Security, and scans use Code Security AI credits, so set a budget before switching it on across the organisation.
Which should you turn on first?
npm trusted publishing audit. Free, already in force and it closes a package takeover path. Do it now.
Package firewall for CI and agents. If you are on Enterprise Cloud, the preview costs nothing and blocks malware at install time.
AI Scan on infrastructure repos. Terraform and Dockerfile repos gain the most, but watch the credit spend.
Push attribution. Worth requesting for audit trails, but map your bots first.
GitHub is closing gaps attackers have been using for years. The firewall is the one that matters most once it reaches general availability, and the pricing will decide how many teams keep it on.
Quick answers
Do npm trusted publishing configurations expire?
Yes, if they are never used. A configuration that has not completed a successful publish lapses 48 hours after creation. Once validated by a first publish, it does not expire.
Who can use the GitHub package firewall?
It is in public preview for all GitHub Enterprise Cloud customers, including data-resident Enterprise Cloud. It covers npm only, is free during preview and will be metered at general availability.
Can AI Scan block a pull request merge?
No. AI Scan findings are advisory. They do not fail the code scanning check and rulesets cannot use them to block merges.
