In response to the recent supply chain attack in the JavaScript package manager npm, GitHub has made a few changes that will enable stronger security. The attack on the npm ecosystem was caused by a worm, named Shai-Hulud, that infects and republish other packages with its malware to spread it across the npm ecosystem. “When npm released support for trusted publishing, it was our intention to let adoption of this new feature grow organically. We strongly encourage projects to adopt trusted publishing as soon as possible, for all supported package managers,” GitHub wrote. Additionally, to further improve npm security specifically, GitHub will deprecate legacy classic tokens, deprecate time-based one-time password 2FA, set publishing access to disallow tokens by default, and expand providers for trusted publishing.