Disrupting supply chain attacks on NPM and GitHub Actions

# Summary Supply chain attacks targeting npm and GitHub Actions have increased over the past year, with attackers exploiting weaknesses in package repositories and CI/CD systems to spread malware and steal credentials across open source projects. To disrupt these attacks, npm and GitHub have implemented several security improvements, including account protection measures for high-impact npm accounts (freezing them for 72 hours after email changes or 2FA recovery) and safer defaults for GitHub Actions checkout to prevent execution of untrusted code from pull request forks. These changes target the most common attack techniques used to compromise projects and limit the impact of successful breaches.