GitHub limits unvalidated npm publishing trust to 48 hours

GitHub has imposed a 48-hour expiry on unvalidated npm trusted publishing configurations after researchers found a way to publish versions of other users' packages without stealing credentials. A first successful publish validates the configuration and binds it to the repository's permanent identity. Before that first publish, npm trusted a repository's name, allowing an attacker to claim an abandoned name and inherit its publishing authority. Bloom Security said it found over 1,500 vulnerable packages with more than 10 million collective downloads. Npm also now rejects trusted publishing tokens from GitHub Actions issue_comment events. Changing a repository or project identity requires a fresh trust relationship and validation window.