GitHub Adds 48-Hour Expiry to npm Publishing Settings After Package Hijacking Flaw

GitHub has changed how npm trusted publishing works after researchers at Bloom Security found it was possible for an attacker to publish new versions of another user's package without stealing their credentials. Under the new rules, an unvalidated trusted publishing configuration now expires 48 hours after it is created. It becomes validated and exempt from expiry once it completes its first successful publish. Changing the repository or project identity requires a fresh trust relationship and a new 48-hour window.

GitHub said the change contains the risk that comes from trusting a repository or project name that changes ownership. The configuration is now bound to the repository's immutable identity. npm will also reject trusted publishing tokens from GitHub Actions issue_comment events, in addition to the existing pull_request_target restriction. Bloom Security reported its findings to GitHub on June 6, 2026, and said the loophole could be used to take over thousands of packages and trigger a Shai-Hulud-style cascading supply chain attack.

Researcher Golan Myers described how one compromised package could spread: an AI agent on a popular maintainer's device might pull it automatically, and that device could then be used to push malicious code to the popular package, exposing all its users. Trusted publishing launched in npm in July 2025. It lets developers publish from CI/CD platforms such as GitHub Actions using short-lived OpenID Connect tokens that the npm registry checks against a pre-authorized configuration.