GitHub Adds 48-Hour Expiry to Unvalidated npm Trusted Publishing Setups

GitHub has changed how npm trusted publishing works after researchers showed that a flaw allowed an attacker to publish new versions of a package belonging to a different user, without needing to steal that user's credentials.

What changed

Under the new rule, a trusted publishing configuration that has not been validated expires 48 hours after it is created. GitHub states that a configuration becomes validated, and exempt from expiry, once its first publish succeeds. The source's headline says more than 1,500 packages were left exposed to hijacking by the flaw.

Why it matters

Trusted publishing is meant to remove long-lived tokens from release pipelines. A weakness in that mechanism is therefore significant, because a malicious version could reach downstream users through a normal update, with no credential theft to detect. Organisations that depend on npm packages, directly or through their vendors, inherit that exposure.

The source excerpt does not describe how the flaw was exploited, whether it was abused in the wild, or which packages were affected. Teams should avoid assuming either way and instead verify their own configurations and dependencies.

Practical view

The 48-hour expiry narrows the window in which a pending, unvalidated configuration can be misused. It does not replace review of existing setups. Maintainers should confirm that every trusted publishing entry is intentional and has completed a legitimate first publish.