Developer accounts are the new front line in supply chain security
Software supply chain attacks rarely begin with exploiting a vulnerability in code. More often, they start with a compromised developer account, gained through social engineering, credential theft, or leaked passwords. Once an attacker controls a developer account, they can steal private repositories or push malicious changes directly into projects that may be depended on by thousands of other applications.
To address this, GitHub has announced that by the end of 2023, all users who contribute code on GitHub.com will be required to enable at least one form of two-factor authentication (2FA). This includes users who commit code, open or merge pull requests, use GitHub Actions, or publish packages. The requirement is part of a broader, platform-wide push to harden the software ecosystem by securing the accounts of individual developers.
Why password-only accounts remain a weak link
Most breaches are not the result of exotic zero-day exploits. They are the product of lower-cost attacks such as phishing, credential stuffing, and other methods that give attackers broad access to victim accounts and everything those accounts can reach. A compromised account puts not only the individual and their organization at risk, but also any downstream users of the code they maintain. The potential for cascading impact across the software supply chain is substantial.
GitHub has already moved beyond simple password authentication in several areas, including deprecating basic authentication for git operations and the API, and requiring email-based device verification alongside usernames and passwords. 2FA is the next line of defense, and its effectiveness is well documented. Yet adoption across the ecosystem remains low: only about 16.5% of active GitHub users and 6.44% of npm users currently use one or more forms of 2FA.
This initiative follows earlier steps GitHub has taken to protect developers, including seeking and invalidating known-compromised user passwords, supporting WebAuthn security keys, and enrolling all npm publishers in enhanced login verification. The npm ecosystem saw package takeovers in late 2021 from compromised developer accounts without 2FA enabled, which led to new security investments in npm account protection. The new GitHub-wide requirement extends that same focus to the broader developer community.
GitHub's position as the home for a large share of the world's developers means it has both an opportunity and a responsibility to raise the bar for account security across the industry. No matter how much investment goes into platform-level security, that value is fundamentally limited if the risk of account compromise remains unaddressed at the individual level.
What developers can do now
Developers who want to get ahead of the requirement have several options already available. GitHub recently launched 2FA for GitHub Mobile on iOS and Android, which requires at least one other form of 2FA to be enabled first before it can be configured.
Phishing-resistant options are also available. WebAuthn security keys such as YubiKey, SoloKeys, and Titan Security Keys can be configured as a 2FA method. GitHub has distributed security keys to critical open source maintainers and stocks GitHub-branded YubiKeys in its shop. Security keys offer a stronger defense against phishing than one-time passcodes because they are tied to the specific site being accessed.
As part of configuring 2FA, users should save their recovery codes and set up at least one account recovery method. GitHub's documentation covers both 2FA configuration for GitHub.com accounts and for npm accounts separately.
Organization and enterprise owners on GitHub.com can already require 2FA for members of their organizations and enterprises. Note that when this setting is enabled, members and owners who do not use 2FA will be removed from the organization or enterprise.
GitHub acknowledges that strong account security should not come at the expense of a good developer experience, and the end-of-2023 timeline is intended to allow for a smooth transition. The company says it will continue exploring new authentication methods, including passwordless authentication, and plans to share more details and timelines for the upcoming 2FA requirements in the coming months. Developers can also expect additional improvements aimed at preventing and recovering from account compromise.
