Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Greg Ose
Disrupting supply chain attacks on npm and GitHub Actions
In the past year, there’s been a pattern of supply chain attacks that target weaknesses in package repositories and CI/CD systems to quickly spread malware to hundreds of open source projects. This malware seeks to exfiltrate credentials both to broadly spread the attack, as well as for later exploitation.
What’s coming to our GitHub Actions 2026 security roadmap
Home / News & insights / Product A look at GitHub Actions’ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end. March 26, 2026 | 9 minutes Share: Why this matters right now Software supply chain attacks aren’t slowing down.
Inside GitHub: How we hardened our SAML implementation
Home / Security / Web application security Maintaining and developing complex and risky code is never easy. See how we addressed the challenges of securing our SAML implementation with this behind-the-scenes look at building trust in our systems. May 27, 2025 | 18 minutes Share: For over a decade, GitHub has offered enterprise authentication using SAML (Security Assertion Markup Language), starting with our 2.0.0 release of GitHub Enterprise Server in November 2014.
New request for comments on improving npm security with Sigstore is now open
As stewards of the npm registry, we take the security of npm seriously and have continued to introduce a number of changes to improve the security and trustworthiness of the registry. We’ve announced a number of changes over the last several months to improve the security of npm, like requiring two-factor authentication, streamlined login, and enhanced signing of artifacts.
Introducing even more security enhancements to npm
The JavaScript community downloads over 5 billion packages from npm a day, and we at GitHub recognize how important it is that developers can do so with confidence. As stewards of the npm registry, it’s important that we continue to invest in improvements that increase developer trust and the overall security of the registry itself.
npm security update: Attack campaign using stolen OAuth tokens
On April 15, we published a blog detailing an attack campaign utilizing stolen OAuth user tokens issued to two third-party GitHub.com integrators, Heroku and Travis CI. The npm organization on GitHub.com was impacted by this campaign and we have been actively investigating the impact of this attack on npm since April 12. Today, we are sharing details of what we’ve learned during our investigation and an additional, though unrelated, finding impacting npm.
Eight years of the GitHub Security Bug Bounty program
GitHub celebrated yet another record breaking year for our Security Bug Bounty Program in 2021! We’re excited to announce that we recently passed $2,000,000 in total payments to researchers, just two years after we crossed the $1,000,000 mark in 2019. Within the last year, we have paid out over $800,000 in total bounty rewards across our programs.
Seven years of the GitHub Security Bug Bounty program
Security is core to GitHub’s mission and our Product Security Engineering team is focused on continuously driving improvements to how GitHub develops secure software. One key component of GitHub’s security development lifecycle is our partnership with security researchers and the bug bounty community through the GitHub Security Bug Bounty Program.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Greg
Contact Greg, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack