GitHub adds 48-hour expiry for unvalidated npm trusted publishing after security flaw

GitHub has added a 48-hour expiration window for unvalidated npm trusted publishing configurations, closing a supply chain loophole that allowed attackers to claim abandoned repository slugs and publish package updates without credentials. The issue was discovered by security firm Bloom Security, which notified GitHub on June 6, 2026. According to the researchers, the vulnerability arose from the way the platform identified which code repository belonged to whom. Specifically, the system relied on the name of the address rather than a permanent digital identifier. This meant that if an address name was left blank, a skilled attacker could figure it out. In this way, they could gain the trust of the system and publish malicious changes to software they did not own, taking advantage of the reputation and downloads of the original package. The research identified more than 1.500 vulnerable packages that had been downloaded a total of over 10 million times. What's changing in software publishing To address this issue, GitHub has decided that trust settings that have not been validated with a successful publish will now automatically expire within 48 hours of their creation. Each setting becomes permanent once the first publish is successfully completed, while if the project identity changes, a new process is required with a new 48-hour window. Additionally, npm rejects requests originating from certain automated code comment and request processes. What should creators do? Software creators who manage packages are asked to: check the settings of trusted connections, delete and recreate links if repositories are renamed or moved, monitor for any unexpected posts. Read the original English article on Hacks.gr

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary

Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom counted more than 1,500 npm packages exposed this way, and GitHub, which owns npm, says it has shipped fixes. The exposed packages have more than 10 million downloads in total and more than a million a … More → The post npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover appeared first on Help Net Security.