Unvalidated npm trusted publishing configurations now expire
GitHub has introduced a 48-hour expiration window for unvalidated npm trusted publishing configurations. Configurations that remain unvalidated beyond this timeframe are automatically invalidated and lose authorization to publish packages.
Verified State Diff
Impact & Verification Analysis
npm package maintainers and developers utilizing GitHub Actions for automated package publishing.
This change reduces the attack surface for supply chain attacks by preventing the persistence of stale or unverified trust configurations that could be hijacked by malicious actors.
Full Fact Overview
Trusted publishing allows developers to publish npm packages using OpenID Connect (OIDC) tokens rather than long-lived access tokens. Previously, configurations could remain in a pending or unvalidated state indefinitely, creating a security window where an attacker could potentially claim a repository or project name to hijack the trust relationship. By enforcing a 48-hour TTL (Time-To-Live) on these configurations, GitHub mitigates the risk of 'dangling' trust relationships that could be exploited if project ownership changes or if a configuration is abandoned.