GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires npm trusted publishing configs after 48 hours to prevent package hijacking.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
GitHub has implemented a 48-hour expiration for unvalidated npm trusted publishing configurations. This change follows the discovery of a vulnerability that allowed attackers to publish new versions of packages without needing to steal legitimate user credentials. The configuration becomes permanent after its first successful publish.
The lesson from this incident
Full lessonA vulnerability in npm's trusted publishing feature allowed attackers to exploit unvalidated publishing configurations, enabling unauthorized package versions to be published without stealing credentials. The flaw highlights how misconfigured or unvalidated CI/CD pipeline integrations can become an attack vector in the software supply chain. Because npm packages are consumed by millions of developers globally, even a single hijacked package can cascade into widespread downstream compromise. GitHub's 48-hour expiration window for unvalidated configurations is a meaningful mitigation, but organizations must also audit their own dependency chains for affected packages.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.