[security] Temporarily closing PRs from external contributors (rescinded)

[franky47]

The recent attacks on the NPM ecosystem (last in date being the TanStack infection with Mini Shai-Hulud yesterday) combined with the lack of proper tools on GitHub's side to properly defend against supply chain attacks mean it's up to us, maintainers, to take action to defend our community.

As I write this, nuqs is downloaded around 2.5M times weekly. Sure, the volume of PRs isn't huge, but it only takes one bad apple to spoil the bunch. I've been doing some research to harden our CI/CD workflows, and I'm mostly happy where we stand. But attackers are becoming more and more ambitious, exploiting things that static scanners, or even (generally available) AI models can't pinpoint. It takes only one angle that I haven't defended against to pwn projects that I love. And this sucks.

So for this reason, and for the time being, I'm stopping accepting PRs from external contributors (it's a setting in the General repository settings):

It's sad we're arriving at this point, because OSS is about the open sharing of code and community improvement. Reactions like making repos private or moving off of GitHub seem a bit extreme to me, but I feel like attacks like this are only the tip of the iceberg ahead. Pausing incoming PRs keeps the discussions open, which is what really matters: connections between people, more than the code itself.

I've got some ideas I want to play with to try and nip attacks in the bud that would result in a malicious npm package being published, and I'll re-allow external PRs when I feel like we're equipped with better tools to defend ourselves. What shape this ends up taking is currently unknown.

[abdirahmanmahamoud]

It’s good that you stopped accepting new PRs until stronger protections are found

[franky47]

note: As of today, PRs are reopened and welcome again in nuqs! 🎉

It took me a bit over a month, but I think we've landed in a good state in terms of supply chain security. Here's what changed:

1. I deleted the last pull_request_target workflow (that was doing some milestone automation, more on that below)
2. All actions dependencies are SHA-1 pinned and enforced in the GitHub settings:

3. Workflow permissions are read-only by default, and explicitly extended where needed (at the right job scope)

4. NPM settings are set to only allow staged publishing

5. Builds are reproducible and verifiable both during the staging review process (to detect tampering within the GitHub actions workflow runs) and after packages are live on the NPM registry, with the following command:

pnpm verify v2.9.0 # and higher, won't work for older versions

6. OIDC Trusted publishing is still on, but we minimise the duration of the job that stages to npm to avoid exposing unnecessary code to the id-token: write permission.
7. using persist-credentials: false on all checkouts, to keep the GITHUB_TOKEN out of .git/config
8. The release model was shifted from pushing on master (which deployed the docs to nuqs.dev and published on npm) to a 4-step process:
   a. Manual trigger of the release-draft workflow: stages to NPM & opens a draft GitHub Release
   b. Manual review on my local working copy (reproducing the staged build & comparing hashes to detect tampering)
   c. 2FA approval of the staged package to promote it to the live NPM registry
   d. Publishing of the GitHub Release which comments on issues & updates the changelog in the docs

This custom release workflow also fixes some gaps I had with semantic-release, and allows more control over the process.

9. pnpm 11 is set with its default minimumReleaseAge of 24h.
10. The staging job doesn't recall any cache (to avoid the cache poisoning attacks that hit TanStack)
11. On my dev machine, I have setup the Socket Firewall that blocks malicious packages during install, and I'm also looking at trying AutomicVault by @mxcl (the creator of Homebrew).

[mxcl]

would love your feedback! I’m still actively fiddling with it but as it stands it's an easy install that at the very least, even if you do nothing else, tells you how secure your current set up is.