GitHub locks high-impact npm accounts for 72 hours

GitHub locks high-impact npm accounts into a 72-hour read-only mode after a credential change, per its July 28 security rundown.

The freeze targets account takeover, when stolen credentials let an attacker push a malicious version of a popular package before anyone notices. Three days of forced read-only status gives maintainers time to catch the swap.

Staged publishing landed in May, the first of several changes GitHub stacked through the year.

Npm v12 shipped in June and turns off install scripts by default, closing a technique attackers use to run code the moment a package installs.

Dependabot added a three-day cooldown on version updates in July, delaying how fast it suggests a bump to a version that's only hours old.

Actions gets the same treatment

GitHub's CI product picked up parallel changes: safer pull_request_target defaults, new workflow execution policies, and a read-only Actions cache for untrusted triggers. A network firewall is still in technical preview.

Install scripts off by default in npm v12 stops more attacks than the 72-hour freeze, since malicious scripts run before any alert can matter. Watch whether GitHub reports install-script abuse dropping since scripts became opt-in.