https://github.blog/changelog/2023-04-19-npm-provenance-public-beta/

 / Blog

  * Engineering
  * Product
  * Security
  * Open Source
  * Enterprise
  * Changelog
  * Community
  * Education
  * Company
  * Policy

Free trial Contact sales  
Search by Keyword
[                    ]
Search
npm provenance public beta

  * npm
  * security

  *  
  *  
  *  

April 19, 2023

npm packages built on a cloud CI/CD system (like GitHub Actions) can
now publish with provenance, meaning the package has verifiable links
back to its source code and build instructions.

The cloud CI/CD system securely communicates this information by
sending provenance information in a signed OIDC JWT to Sigstore's
public-good servers, which returns a signing certificate that is sent
to the registry along with your built package.

Here's an example of how to do a build with provenance in a GitHub
Actions workflow:

name: Publish Package to npmjs
on:
 release:
   types: [created]
jobs:
 build:
   runs-on: ubuntu-latest
   permissions:
     contents: read
     id-token: write
   steps:
     - uses: actions/checkout@v3
     - uses: actions/setup-node@v3
       with:
         node-version: '18.x'
         registry-url: 'https://registry.npmjs.org'
     - run: npm install -g npm
     - run: npm ci
     - run: npm publish --provenance --access public
       env:
         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Once published, packages display provenance on the registry website:

Provenance displayed on the registry website

Dependencies with provenance can also be verified from the command
line with npm audit signatures.

For more information, see generating provenance.

Open a private vulnerability report with REST API

April 18, 2023

  * advisory-database
  * security
  * security-and-compliance

You can now use the REST API to open a private vulnerability report
on open-source repositories that have this feature enabled.

Learn more about the repository security advisories REST API

See more See more

Fixed bug that allowed a hovercard URL to be used to display the
name, description, and star count of any repository

April 17, 2023

  * repositories
  * security

On March 30, 2023, we fixed a bug that allowed a dependency graph
hovercard URL to be used to retrieve the name, description, and star
count of any repository on GitHub.com. The bug was introduced on
March 28, 2023 and our investigation has found no evidence of
exploitation. To exploit the bug, a specific header needed to be set
when making a request to the URL and the numeric ID of a repository
provided. The URL would then return the HTML content designed to be
used for a hovercard UI element with the repository name,
description, and star count in the response.

This bug was reported to GitHub via the GitHub Bug Bounty program.

See more See more
View all changes

Subscribe to The GitHub Insider

A newsletter for developers covering techniques, technical guides,
and the latest product innovations coming from GitHub.

[                    ]
Subscribe
[ ] Yes please, I'd like GitHub and affiliates to use my information
for personalized communications, targeted advertising and campaign
effectiveness. See the GitHub Privacy Statement for more details.
Subscribe
 

Product

  * Features
  * Security
  * Enterprise
  * Customer Stories
  * Pricing
  * Resources

Platform

  * Developer API
  * Partners
  * Atom
  * Electron
  * GitHub Desktop

Support

  * Docs
  * Community Forum
  * Training
  * Status
  * Contact

Company

  * About
  * Blog
  * Careers
  * Press
  * Shop

  * GitHub on Twitter
  * GitHub on Facebook
  * GitHub on YouTube
  * GitHub on Twitch
  * GitHub on TikTok
  * GitHub on LinkedIn
  * GitHub's organization on GitHub

  * (c) 2023 GitHub, Inc.
  * Terms
  * Privacy