Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitHub expires unvalidated npm trusted publishing configurations after 48 hours

Security Tool/Service
First reported
Last updated
Happening score
H score 20
1 unique sources, 1 articles

Summary

Hide ▲

GitHub has tightened npm trusted publishing by expiring unvalidated configurations after 48 hours, closing a package-hijack path tied to reclaimed repository slugs. The change also rejects certain GitHub Actions token flows, reducing abuse of the trust exchange used to publish packages. The update hardens package publishing authentication and limits unauthorized releases under legitimate package names.

Related Happenings

GitHub Dependabot and PyPI add time-based supply-chain defenses

Security Tool/Service
H score11 First: 26.07.2026 17:13 Last: 26.07.2026 17:13 Sources 1

About this happening: GitHub Dependabot and PyPI added time-based controls that slow malicious package adoption and restrict late release tampering across the software supply chain. Dependabo...

Open Happening

AsyncAPI malicious npm package supply-chain malware

Malware Activity
H score21 First: 15.07.2026 18:37 Last: 15.07.2026 18:37 Sources 1

About this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...

Open Happening

AsyncAPI repositories and npm publishing workflow hit by network compromise

Incident
H score27 First: 15.07.2026 12:16 Last: 15.07.2026 12:16 Sources 1

About this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...

Open Happening

GitHub npm version 12 hardens installs and token management

Security Tool/Service
H score11 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...

Open Happening

GitHub npm GAT publish-token mitigation guidance

Advisory/Mitigation
H score25 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub is steering npm users away from long-lived publish tokens as npm GATs that bypass 2FA lose direct publishing and sensitive-management abilities. The recomme...

Open Happening

Timeline

  1. 13.10.2026 19:18 2 articles · 1h ago

    GitHub expires unvalidated npm trusted publishing configurations after 48 hours

    Mitigation Patch Update

    GitHub changed npm trusted publishing so newly created configurations must complete a first successful publish within 48 hours, after which the configuration becomes validated and tied to the repository's immutable identity. GitHub also said npm rejects trusted publishing tokens from GitHub Actions issue_comment events going forward, alongside the Existing pull_request_target restriction.

    Show sources
    Open in new tab
  2. 06.06.2026 03:00 1 articles · 4mo ago

    Bloom Security reports an npm trusted publishing slug loophole to GitHub

    Initial Disclosure

    Bloom Security reported to GitHub on June 6, 2026 that npm's trusted publishing could be abused through a reclaimed GitHub repository slug, allowing an attacker to push new versions of another user's package without stealing credentials. The finding described a Shai-Hulud-style cascading supply chain risk and identified a trust binding problem between the slug and the repository's immutable identity.

    Show sources
    Open in new tab