What's this about?
GitHub's security team detailed measures against attackers who compromise packages (NPM) and CI/CD pipelines (GitHub Actions) to slip malicious code into many downstream projects at once.
What exactly is a "supply-chain attack"?
Instead of attacking you directly, the attacker poisons something you depend on — a library, a build action — so the malware rides in through your normal `install`/`build`. One compromised package can hit thousands of projects.
Why it matters
It's the mundane-but-critical counterpart to the day's flashy AI-security stories: most real breaches still come through dependencies and build systems, and AI agents that auto-install and auto-run only widen that surface.