GitHub and npm are adding more friction to package and workflow paths that attackers use to turn developer infrastructure into a distribution channel.
The July 28 updates include npm malware scanning before newly published packages become installable, a dual-use content declaration for legitimate security-relevant packages, expanded Dependabot malware alerts using OpenSSF data, and automatic holds for some potentially malicious GitHub Actions workflow runs in public repositories.
GitHub does not frame every one of these changes as an AI response. The timing still fits the risk pressure that AI agents increase: more automated discovery, more credential abuse, more generated packages, and faster movement through CI/CD systems.
npm will scan before packages are available
npm says newly published packages will be automatically scanned before they become available for install. A package can publish normally, be held for manual review, or be blocked.
The expected delay is usually around five minutes, with longer waits possible at peak times or depending on package content and size. npm warns maintainers to update automation that assumes a new version can be installed immediately after publication.
The registry is also adding a contentPolicy field in package.json for dual-use content. Maintainers declaring dual-use functionality must include a plain-text DISCLOSURE file describing the capability and its legitimate use. Those packages must be published through a 2FA-enforced method, and future versions cannot remove the declaration or disclosure file.
Alerts and workflow holds move earlier in the chain
GitHub says the GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository. Dependabot can match dependencies against that expanded malware data across ecosystems including npm and PyPI when malware alerting is enabled.
The GitHub Actions change is more direct. Public repositories on github.com may now have certain workflow runs held for approval before execution when GitHub identifies them as potentially malicious. A collaborator with write access must approve the run through an authenticated web session before it proceeds.
That is a shift from detection after install or execution toward interruption before downstream damage. It will add some operational delay, but delay is the point when the alternative is a malicious package or workflow running automatically with developer or CI/CD trust.
