GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials.

"Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary said. "Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window -- ordinary edits don't restart the deadline."

The change contains the risk associated with trusting a repository or project name that changes ownership, GitHub said, adding npm also rejects trusted publishing tokens from GitHub Actions issue_comment events going forward, along with the Existing pull_request_target restriction.

In an update to its documentation, GitHub states that a newly created trusted publisher configuration must complete its first successful publish within two days, which validates the configuration and binds it to the "repository's immutable identity."

The development comes in response to findings from Bloom Security, which discovered a loophole within npm's trusted publishing to take over thousands of packages and trigger a Shai-Hulud-style cascading supply chain attack. The findings were reported to GitHub on June 6, 2026.

"Imagine this: an attacker compromises a single package. An AI agent on a popular package maintainer's device autonomously pulls it for a project," security researcher Golan Myers said. "That single endpoint is used to push malicious code to the popular package. All the package users are exposed.

Source link