Do Son 
GitHub Tightens npm Trusted Publishing Rules
GitHub has changed the rules for npm trusted publishing. A new configuration that does not complete its first successful publish within 48 hours will now fail. After that, it can no longer publish packages.
The change targets a repository name reuse flaw that researchers uncovered. That flaw could let attackers bypass a package maintainer’s credentials and push new versions to someone else’s npm package.
How Abandoned Repository Names Enable Attacks
npm trusted publishing lets GitHub Actions publish packages with short-lived OIDC tokens. Therefore, workflows no longer need to store long-lived access tokens.
However, security researchers found a gap. Before a configuration completes its first successful publish, npm builds trust mainly on the GitHub repository’s owner/repo name and the workflow file name. At that stage, it has not yet bound the configuration to the repository’s immutable identity.
The Attack Path
If a maintainer renames, transfers, or deletes a repository, the old name may become available again. An attacker can then register a repository with the same name and create a workflow with a matching name.
In this way, the attacker obtains npm publishing credentials. Consequently, they can publish a malicious version under the original package name.
The Scale of the Risk
Researchers estimate that more than 1,500 npm packages are affected. Together, those packages have more than 10 million downloads. A malicious version could keep spreading under the original package’s name and to its existing users.
GitHub Strengthens Verification
On October 2, GitHub announced that a trusted publishing configuration must complete its first successful publish within 48 hours of creation. Once the publish succeeds, the configuration binds to the repository’s immutable identity and is no longer subject to the deadline.
If the repository or project identity changes, maintainers must set up a new trust configuration and verify it again. Ordinary edits, however, do not reset the 48-hour window.
Fewer Risky Workflow Triggers
In addition, npm now rejects trusted publishing tokens triggered by the GitHub Actions issue_comment event. The pull_request_target event was already restricted.
Affected publishing workflows can switch to events such as push, release, or workflow_dispatch.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
